{"action":"Upgrade pyspark to 2.2.3 or later.","affected":[{"fixed":"2.2.3","introduced":"1.0.2"},{"fixed":"2.3.2","introduced":"2.3.0"}],"component":"pyspark","cve_ids":["CVE-2018-11760"],"ecosystem":"PyPI","epss":0.00605,"exploited":false,"fixed_versions":["2.3.2","2.2.3"],"ghsa_id":"GHSA-fvxv-9xxr-h7wj","id":"tcs_01M5KG8QQZDG5SP682YYMHSYDZ","modified_at":"2023-11-08T03:59:46.761283Z","published_at":"2019-02-04T17:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-169","https://lists.apache.org/thread.html/a86ee93d07b6f61b82b61a28049aed311f5cc9420d26cc95f1a9de7b@%3Cuser.spark.apache.org%3E","http://www.securityfocus.com/bid/106786","https://lists.apache.org/thread.html/6d015e56b3a3da968f86e0b6acc69f17ecc16b499389e12d8255bf6e@%3Ccommits.spark.apache.org%3E","https://github.com/advisories/GHSA-fvxv-9xxr-h7wj"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-169","url":"https://osv.dev/vulnerability/PYSEC-2019-169"}],"summary":"When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application. This affects versions 1.x, 2.0.x, 2.1.x, 2.2.0"}