GHSA-fp5j-3fpf-mhj5HighCVSS 7.5

Sensitive data written to disk unencrypted in Spark

Published
August 8, 2019
Last Modified
October 24, 2024

🔗 CVE IDs covered (1)

CVE-2019-10099 →

📋 Description

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

🎯 Affected products2

  • maven/org.apache.spark:spark-core_2.11:< 2.3.3
  • pip/pyspark:>= 0, < 2.3.3

🔗 References (6)