https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:20:23 +0000 https://cve.radiocsirt.org/vuln/cve-2025-55039 <p><strong>Affected:</strong> Apache Software Foundation Apache Spark</p> <p>This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.</p> <p>Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.</p> <p>When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.</p> <p>This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.</p> <p>To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or</p> <p>enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Spark</p> <p>This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.</p> <p>Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.</p> <p>When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.</p> <p>This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.</p> <p>To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or</p> <p>enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.</p> https://cve.radiocsirt.org/vuln/cve-2025-55039 https://cve.radiocsirt.org/vuln/ghsa-6p6v-m64v-jx8q <p><strong>Affected:</strong> Maven: org.apache.spark:spark-network-common_2.13, Maven: org.apache.spark:spark-network-common_2.12, PyPI: pyspark</p> <p>This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.</p> <p>Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.</p> <p>When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.</p> <p>This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.</p> <p>To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.</p> <p><strong>Affected:</strong> Maven: org.apache.spark:spark-network-common_2.13, Maven: org.apache.spark:spark-network-common_2.12, PyPI: pyspark</p> <p>This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0.</p> <p>Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes.</p> <p>When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication.</p> <p>This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows.</p> <p>To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.</p> https://cve.radiocsirt.org/vuln/ghsa-6p6v-m64v-jx8q