https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:51:29 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-09903 bdu:2025-09903 https://cve.radiocsirt.org/vuln/bdu:2025-09903 https://cve.radiocsirt.org/vuln/bit-spark-2020-9480 <p><strong>Affected:</strong> Bitnami: spark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> <p><strong>Affected:</strong> Bitnami: spark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> https://cve.radiocsirt.org/vuln/bit-spark-2020-9480 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1165 https://cve.radiocsirt.org/vuln/cnvd-2020-34445 cnvd-2020-34445 https://cve.radiocsirt.org/vuln/cnvd-2020-34445 https://cve.radiocsirt.org/vuln/euvd-2026-39152 EUVD-2026-39152 https://cve.radiocsirt.org/vuln/euvd-2026-39152 https://cve.radiocsirt.org/vuln/fkie_cve-2020-9480 <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-9480 https://cve.radiocsirt.org/vuln/ghsa-wgx7-jwwm-cgjv <p><strong>Affected:</strong> Maven: org.apache.spark:spark-parent_2.11, PyPI: pyspark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> <p><strong>Affected:</strong> Maven: org.apache.spark:spark-parent_2.11, PyPI: pyspark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> https://cve.radiocsirt.org/vuln/ghsa-wgx7-jwwm-cgjv https://cve.radiocsirt.org/vuln/gsd-2020-9480 gsd-2020-9480 https://cve.radiocsirt.org/vuln/gsd-2020-9480 https://cve.radiocsirt.org/vuln/pysec-2020-95 <p><strong>Affected:</strong> PyPI: pyspark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> <p><strong>Affected:</strong> PyPI: pyspark</p> <p>In Apache Spark 2.4.5 and earlier, a standalone resource manager&#39;s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application&#39;s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).</p> https://cve.radiocsirt.org/vuln/pysec-2020-95