CVE-2017-12612
published 2017-09-13CVE-2017-12612: In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched…
PriorityP341high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.73%
50.4th percentile
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
| apache | spark | — | — |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
vendor_apache7.8
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apache
Apache spark: CVE-2017-12612
vendor_apache·CVSS 7.8
CVE-2017-12612 Apache spark: CVE-2017-12612
Apache spark: CVE-2017-12612
JIRA: SPARK-20922 Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Versions of Apache Spark from 1.6.0 until 2.1.1 Description: In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later. Mitigation: Update to Apache Spark 2.1.2, 2.2.0 or later. Credit: Aditya Sharad, Semmle
Severity
OSV
Apache Spark Deserialization of Untrusted Data vulnerability
osv·2018-11-09
CVE-2017-12612 [HIGH] Apache Spark Deserialization of Untrusted Data vulnerability
Apache Spark Deserialization of Untrusted Data vulnerability
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.
GHSA
Apache Spark Deserialization of Untrusted Data vulnerability
ghsa·2018-11-09
CVE-2017-12612 [HIGH] CWE-502 Apache Spark Deserialization of Untrusted Data vulnerability
Apache Spark Deserialization of Untrusted Data vulnerability
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.1.2, 2.2.0 or later.
OSV
CVE-2017-12612: In Apache Spark 1
osv·2017-09-13
CVE-2017-12612 CVE-2017-12612: In Apache Spark 1
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/100823https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3Ehttp://www.securityfocus.com/bid/100823https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E
2017-09-13
Published