CVE-2018-17190 json
Remote Code Execution in spark-core
published 2018-11-19 7 y ago modified 2026-06-17 4 mo ago also GHSA-phg2-9c5g-m4q7 , EUVD-2018-0765
- cvss
- 9.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 8.8%
- EPSS 8.8% chance of exploitation in 30 days, percentile 95%
- public exploits
- 0
- none known
Summary
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'worker' hosts. The master itself does not, by design, execute user code. A specially-crafted request to the master can, however, cause the master to execute code too. Note that this does not affect standalone clusters with authentication enabled. While the master host typically has less outbound access to other resources than a worker, the execution of code on the master is nevertheless unexpected.
Exploit prediction
8.79% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| GitHub | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.spark:spark-core_2.11 | all versions |
no fix listed |
| maven | org.apache.spark:spark-core_2.10 | all versions |
no fix listed |
Affected products
- Apache Software Foundation Apache Spark
References
-
security.gentoo.org
/glsa/201903-21
vendor-advisory, web, third-party-advisory
-
securityfocus.com
/bid/105976
vdb-entry, web, third-party-advisory
-
oracle.com
/security-alerts/cpujul2020.html
web
- lists.apache.org /thread.html/341c3187f15cdb0d353261d2bfecf2324d56cb7db1339bfc7b30f6e5%40%3Cdev.spark.apache.org%3E
-
nvd.nist.gov
/vuln/detail/CVE-2018-17190
advisory
-
github.com
/advisories/GHSA-phg2-9c5g-m4q7
advisory
-
lists.apache.org
/thread.html/341c3187f15cdb0d353261d2bfecf2324d56cb7db1339bfc7b30f6e5@%3Cdev.spark.apache.org%3E
web
Sources
- CVE List CVE-2018-17190
- GitHub Advisory GHSA-phg2-9c5g-m4q7
- NVD CVE-2018-17190
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.