{"action":"Upgrade pyspark to 2.4.6 or later.","affected":[{"fixed":"2.4.6","introduced":"0"}],"component":"pyspark","cve_ids":["CVE-2020-9480"],"ecosystem":"PyPI","epss":0.2937,"exploited":false,"fixed_versions":["2.4.6"],"ghsa_id":"GHSA-wgx7-jwwm-cgjv","id":"tcs_01M5KGAZK6W387NH1QXK0W8W0S","modified_at":"2026-06-10T17:01:36.994430040Z","published_at":"2020-06-23T22:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-95","https://spark.apache.org/security.html#CVE-2020-9480","https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2@%3Cdev.spark.apache.org%3E","https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b@%3Cuser.spark.apache.org%3E","https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d@%3Ccommits.submarine.apache.org%3E","https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b@%3Ccommits.doris.apache.org%3E","https://github.com/advisories/GHSA-wgx7-jwwm-cgjv"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-95","url":"https://osv.dev/vulnerability/PYSEC-2020-95"}],"summary":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft"}