id: PYSEC-2022-186
details: Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate"
  and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke
  mutual authentication protocol that allows for full encryption key recovery. After
  an initial interactive attack, this would allow someone to decrypt plaintext traffic
  offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption",
  "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity".
  Update to Apache Spark 3.1.3 or later
affected:
- package:
    name: pyspark
    ecosystem: PyPI
    purl: pkg:pypi/pyspark
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.1.3
  versions:
  - 2.1.1
  - 2.1.2
  - 2.1.3
  - 2.2.0
  - 2.2.1
  - 2.2.2
  - 2.2.3
  - 2.3.0
  - 2.3.1
  - 2.3.2
  - 2.3.3
  - 2.3.4
  - 2.4.0
  - 2.4.1
  - 2.4.2
  - 2.4.3
  - 2.4.4
  - 2.4.5
  - 2.4.6
  - 2.4.7
  - 2.4.8
  - 3.0.0
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.1.1
  - 3.1.2
references:
- type: WEB
  url: https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd
- type: ADVISORY
  url: https://github.com/advisories/GHSA-9rr6-jpg7-9jg6
aliases:
- CVE-2021-38296
- GHSA-9rr6-jpg7-9jg6
modified: "2022-05-17T21:40:53.336457Z"
published: "2022-03-10T09:15:00Z"