SP
Product
Spark
On CISA KEVExploited in the wild
23
CVEs
1
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 4High 8Medium 11Low 0
Watch
Add Spark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-22946 | 9.9 | Apr 17 | In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges Affected: before 3.4.0 |
| CVE-2020-9480 | 9.8 | Jun 23 | In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret Affected: through 2.4.5 |
| CVE-2018-17190 | 9.8 | Nov 19 | In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts Affected: All versions, or not specified |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 2.4.7; 2.4.8 |
Showing 4