~ / search / GHSA-fp5j-3fpf-mhj5

GHSA-fp5j-3fpf-mhj5

Sensitive data written to disk unencrypted in Spark

Source: GitHub Advisory Database (reviewed) High CVE-2019-10099

Packages

EcosystemPackageAffectedFixed in
Maven org.apache.spark:spark-core_2.11 < 2.3.3 2.3.3
PyPI pyspark < 2.3.3 2.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.

References

External links from the advisory. They lead to third-party sites.