CVE-2020-9480: fallo en Apache Spark
Publicada el · Actualizada el
45Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actepss 29%
de la publicación al arma
Publicada en NVD23 jun
VulnCheck+1417d
probabilidad de explotación
29%top 2% de las CVE
explotación observada
síVulnCheck
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Productos afectados
Apache Software Foundation · Apache SparkCVEs relacionadas — Apache Spark
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-33891HIGHApache Spark shell command injection vulnerability via Spark UIEPSS 93.2%KEVCVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 76.0%CVE-2018-11770—CVE-2018-11770EPSS 65.8%CVE-2018-17190—CVE-2018-17190EPSS 8.8%CVE-2018-11804—CVE-2018-11804EPSS 5.7%CVE-2025-54920HIGHApache Spark: Spark History Server Code Execution VulnerabilityEPSS 5.4%
Referencias
https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3Ehttps://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3Ehttps://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3Ehttps://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3Ehttps://spark.apache.org/security.html#CVE-2020-9480https://www.oracle.com/security-alerts/cpuApr2021.html