In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to…

Description

In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.

Scores

EPSS (exploitation in 30 days)

0.51% · top 56% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.7.

Weakness

• Information Disclosure
• CWE-200 (opens in a new tab)All about CWE-200 and its CVEs

Affected products

• Apache Software Foundation · Apache Spark

  • affected 1.0.0 to 2.1.2
  • affected 2.2.0 to 2.2.1
  • affected 2.3.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.spark:spark-core_2.10GHSA-6mqq-8r44-vmjc (opens in a new tab)
• Mavenorg.apache.spark:spark-core_2.11GHSA-6mqq-8r44-vmjc (opens in a new tab)
• PyPIpysparkGHSA-6mqq-8r44-vmjc (opens in a new tab)

References (2)

• https://spark.apache.org/security.html#CVE-2018-1334 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [dev] 20180711 CVE-2018-1334 Apache Spark local privilege escalation vulnerability (opens in a new tab)mailing-listx_refsource_MLISTx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-6mqq-8r44-vmjc (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2018-1334](https://trackcve.app/badge/CVE-2018-1334.svg)](https://trackcve.app/cve/CVE-2018-1334)

Record last updated 17 Sept 2024, 03:22 UTC.