id: PYSEC-2020-95
details: In Apache Spark 2.4.5 and earlier, a standalone resource manager's master
  may be configured to require authentication (spark.authenticate) via a shared secret.
  When enabled, however, a specially-crafted RPC to the master can succeed in starting
  an application's resources on the Spark cluster, even without the shared key. This
  can be leveraged to execute shell commands on the host machine. This does not affect
  Spark clusters using other resource managers (YARN, Mesos, etc).
affected:
- package:
    name: pyspark
    ecosystem: PyPI
    purl: pkg:pypi/pyspark
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 2.4.6
  versions:
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
references:
- type: WEB
  url: https://spark.apache.org/security.html#CVE-2020-9480
- type: WEB
  url: 
    https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2@%3Cdev.spark.apache.org%3E
- type: WEB
  url: 
    https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b@%3Cuser.spark.apache.org%3E
- type: WEB
  url: 
    https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d@%3Ccommits.submarine.apache.org%3E
- type: WEB
  url: 
    https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b@%3Ccommits.doris.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-wgx7-jwwm-cgjv
aliases:
- CVE-2020-9480
- GHSA-wgx7-jwwm-cgjv
modified: "2021-04-02T12:15:00Z"
published: "2020-06-23T22:15:00Z"