NetSight
IP …
high7.5

CVE-2019-10099

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.

Impact

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

Affected products

VendorProductAffected versions
ApacheSpark
from 1.0.2 through 1.6.3
from 2.0.0 through 2.0.2
from 2.1.0 through 2.1.3
from 2.2.0 through 2.2.2
from 2.3.0 before 2.3.2

Weakness classification

CWE-312

References