Remote Code Execution (RCE) Via Unsafe Deserialization

2017-05-3102:04:33

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

apache-spark is vulnerable to remote code execution (RCE) through unsafe deserialization. A malicious user can pass an object through the port of the system that when deserialized can cause arbitrary code to be executed.

CPENameOperatorVersion
spark project launcherle2.1.1
spark project launcherle2.1.1

CPE	Name	Operator	Version
	spark project launcher	le	2.1.1
	spark project launcher	le	2.1.1

References

github.com/apache/spark/pull/18166

issues.apache.org/jira/browse/SPARK-20922

lgtm.com/projects/g/apache/spark/snapshot/80fdc2c9d1693f5b3402a79ca4ec76f6e422ff13/files/launcher/src/main/java/org/apache/spark/launcher/LauncherConnection.java#V58

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for VERACODE:4329