GSD-2018-11760
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2018-11760",
"description": "When using PySpark , it\u0027s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.",
"id": "GSD-2018-11760",
"references": [
"https://www.suse.com/security/cve/CVE-2018-11760.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2018-11760"
],
"details": "When using PySpark , it\u0027s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1.",
"id": "GSD-2018-11760",
"modified": "2023-12-13T01:22:42.061266Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"DATE_PUBLIC": "2019-01-28T00:00:00",
"ID": "CVE-2018-11760",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Apache Spark",
"version": {
"version_data": [
{
"version_value": "Apache Spark 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1"
}
]
}
}
]
},
"vendor_name": "Apache Software Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "When using PySpark , it\u0027s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "106786",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/106786"
},
{
"name": "[user@spark.apache.org] 20190128 [SECURITY] CVE-2018-11760: Apache Spark local privilege escalation vulnerability",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E"
},
{
"name": "[spark-commits] 20190806 [spark-website] branch asf-site updated: CVE-2019-10099",
"refsource": "MLIST",
"url": "https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "(,2.3.1]",
"affected_versions": "All versions up to 2.3.1",
"cvss_v2": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2019-10-03",
"description": "When used with PySpark it is possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.",
"fixed_versions": [
"2.3.2"
],
"identifier": "CVE-2018-11760",
"identifiers": [
"CVE-2018-11760"
],
"not_impacted": "All versions after 2.3.1",
"package_slug": "maven/org.apache.spark/spark-core",
"pubdate": "2019-02-04",
"solution": "Upgrade to version 2.3.2 or above.",
"title": "Improper Access Control",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2018-11760"
],
"uuid": "2c7659ad-5e61-4997-9a2f-a4431ca5bddd"
},
{
"affected_range": "\u003c2.2.3 || \u003e=2.3.0, \u003c2.3.2",
"affected_versions": "All versions before 2.2.3, all versions starting from 2.3.0 before 2.3.2",
"credit": "Luca Canali, Jose Carlos Luna Duran",
"cvss_v2": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-937"
],
"date": "2019-10-02",
"description": "It\u0027s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.",
"fixed_versions": [
"2.2.3",
"2.3.2"
],
"identifier": "CVE-2018-11760",
"identifiers": [
"CVE-2018-11760"
],
"package_slug": "pypi/pyspark",
"pubdate": "2019-02-04",
"solution": "Upgrade to fixed version.",
"title": "User Impersonation",
"urls": [
"http://www.securityfocus.com/bid/106786",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11760",
"https://cwe.mitre.org/data/definitions/520.html",
"https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E"
],
"uuid": "603dafc9-bdec-45e5-b51a-dfdd71846ded"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.1.3",
"versionStartIncluding": "2.1.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.3.1",
"versionStartIncluding": "2.3.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.6.3",
"versionStartIncluding": "1.0.2",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.0.2",
"versionStartIncluding": "2.0.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.2.2",
"versionStartIncluding": "2.2.0",
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "security@apache.org",
"ID": "CVE-2018-11760"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "When using PySpark , it\u0027s possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[user@spark.apache.org] 20190128 [SECURITY] CVE-2018-11760: Apache Spark local privilege escalation vulnerability",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Vendor Advisory"
],
"url": "https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E"
},
{
"name": "106786",
"refsource": "BID",
"tags": [
"Third Party Advisory"
],
"url": "http://www.securityfocus.com/bid/106786"
},
{
"name": "[spark-commits] 20190806 [spark-website] branch asf-site updated: CVE-2019-10099",
"refsource": "MLIST",
"tags": [],
"url": "https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2019-10-03T00:03Z",
"publishedDate": "2019-02-04T17:29Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…