PyPI/pyspark CVE-2017-12612: high 7.8, EPSS 0.73%
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially
Action: Upgrade pyspark to 2.1.2 or later.
pip install pyspark==2.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.2 | - |
Fixed versions
| 2.1.2 |
Sources
- osv: PYSEC-2017-147
- https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/100823
CVE-2017-12612 · published · modified · JSON