CVE-2018-11804 json
Improper Input Validation in Apache Spark
published 8y ago modified 4mo ago also GHSA-62g2-m955-v383 , EUVD-2022-2689
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 5.7%
- EPSS 5.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 0
- none known
Summary
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.
Patch / fix
- apache spark 2.2.3, 2.3.3
Is CVE-2018-11804 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
5.70% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.spark:spark-core_2.11 | >=1.3.0, <=2.1.3 |
no fix listed |
| maven | org.apache.spark:spark-core_2.10 | >=1.3.0, <=2.1.3 |
no fix listed |
Affected products
- Apache Software Foundation Apache Spark
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
spark.apache.org
/security.html#CVE-2018-11804
web, mitigation, vendor-advisory
-
lists.apache.org
/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E
mailing-list, web, third-party-advisory
-
securityfocus.com
/bid/105756
vdb-entry, broken-link, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2018-11804
advisory
-
github.com
/apache/spark
package
-
lists.apache.org
/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d@%3Cdev.spark.apache.org%3E
web
-
web.archive.org
/web/20200227103903/http://www.securityfocus.com/bid/105756
web
Sources
- CVE List CVE-2018-11804
- GitHub Advisory GHSA-62g2-m955-v383
- NVD CVE-2018-11804
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.