PyPI/pyspark CVE-2020-9480: unknown, EPSS 29.37%
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft
Action: Upgrade pyspark to 2.4.6 or later.
pip install pyspark==2.4.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.4.6 | - |
Fixed versions
| 2.4.6 |
Sources
- osv: PYSEC-2020-95
- https://spark.apache.org/security.html#CVE-2020-9480
- https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2@%3Cdev.spark.apache.org%3E
- https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b@%3Cuser.spark.apache.org%3E
- https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d@%3Ccommits.submarine.apache.org%3E
- https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b@%3Ccommits.doris.apache.org%3E
- https://github.com/advisories/GHSA-wgx7-jwwm-cgjv
CVE-2020-9480 · published · modified · JSON