CVE-2019-10099
published 2019-08-07CVE-2019-10099: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.29%
67.2th percentile
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache_spark | — | — |
| apache | spark | — | — |
| apache | spark | 1.0.2 – 1.6.3 | — |
| apache | spark | 2.0.0 – 2.0.2 | — |
| apache | spark | 2.1.0 – 2.1.3 | — |
| apache | spark | 2.2.0 – 2.2.2 | — |
| apache | spark | >= 2.3.0 < 2.3.2 | 2.3.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_apache7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Sensitive data written to disk unencrypted in Spark
osv·2019-08-08
CVE-2019-10099 [HIGH] Sensitive data written to disk unencrypted in Spark
Sensitive data written to disk unencrypted in Spark
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
GHSA
Sensitive data written to disk unencrypted in Spark
ghsa·2019-08-08
CVE-2019-10099 [HIGH] CWE-312 Sensitive data written to disk unencrypted in Spark
Sensitive data written to disk unencrypted in Spark
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
OSV
CVE-2019-10099: Prior to Spark 2
osv·2019-08-07
CVE-2019-10099 CVE-2019-10099: Prior to Spark 2
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Apache
Apache spark: CVE-2019-10099
vendor_apache·CVSS 7.5
CVE-2019-10099 [HIGH] Apache spark: CVE-2019-10099
Apache spark: CVE-2019-10099
Severity: Important Vendor: The Apache Software Foundation Versions affected: All Spark 1.x, Spark 2.0.x, Spark 2.1.x, and 2.2.x versions Spark 2.3.0 to 2.3.2 Description: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true . This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem ); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs. Mitigation: 1.x, 2.0.x, 2.1.x, 2.2.x, 2.3.x users should upgrade to 2.3.3 or newer, including 2.4.x Credit: This issue was reported by Thomas Graves of NVIDIA.
Severity: high
No detection rules found.
No public exploits indexed.
https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e%40%3Cuser.spark.apache.org%3Ehttps://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae%40%3Ccommits.spark.apache.org%3Ehttps://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2%40%3Cissues.spark.apache.org%3Ehttps://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e%40%3Cuser.spark.apache.org%3Ehttps://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae%40%3Ccommits.spark.apache.org%3Ehttps://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2%40%3Cissues.spark.apache.org%3E
2019-08-07
Published