High severity · published Mar 10, 2022
CVE-2021-38296
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled"
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FS
Financial Services Crime And Compliance Management Studio · Oracle
8.0.8.2.0; 8.0.8.3.0 · source: NVD
SP
Spark · Apache
before 3.1.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-38296
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-38296
Mailing List
https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd
Patch
https://www.oracle.com/security-alerts/cpujul2022.html
More from Spark
8.8
CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
9.9
CVE-2023-22946
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges
9.8
CVE-2020-9480
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret
9.8
CVE-2018-17190
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts
9.1
CVE-2019-20445
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header