Not rated
CVE-2019-10099 Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if…
Description
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Spark | Versions not published |
References
- lists.apache.org lists.apache.org
- [spark-issues] 20200318 [jira] [Commented] (SPARK-28626) Spark leaves unencrypted data on local disk, even with encryption turned on (CVE-2019-10099) lists.apache.org
- [spark-commits] 20200622 [spark-website] branch asf-site updated: CVE-2020-9480 details (#275) lists.apache.org
Timeline
- Published
- Last modified