| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.spark:spark-core_2.11 | < 2.3.3 | 2.3.3 |
| pyspark | < 2.3.3 | 2.3.3 |
| spark | ≥ 1.0.2, ≤ 1.6.3≥ 2.0.0, ≤ 2.0.2≥ 2.1.0, ≤ 2.1.3≥ 2.2.0, ≤ 2.2.2≥ 2.3.0, < 2.3.2 | 2.3.2 |
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free