CVE-2017-12612
2 advisories.
PyPI/pyspark CVE-2017-12612: high 7.8
Apache Spark Deserialization of Untrusted Data vulnerability
Action: Upgrade pyspark to 2.1.2 or later.
pip install pyspark==2.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.2 | - |
Fixed versions
| 2.1.2 |
Sources
- osv: GHSA-8rhc-48pp-52gr
- https://nvd.nist.gov/vuln/detail/CVE-2017-12612
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2017-147.yaml
- https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E
CVE-2017-12612 · published · modified · JSON
PyPI/pyspark CVE-2017-12612: high 7.8
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially
Action: Upgrade pyspark to 2.1.2 or later.
pip install pyspark==2.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.1.2 | - |
Fixed versions
| 2.1.2 |
Sources
- osv: PYSEC-2017-147
- https://mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3E
- http://www.securityfocus.com/bid/100823
CVE-2017-12612 · published · modified · JSON