Read the docs
TI-2017-09337 Aliases CVE-2017-12612GHSA-8rhc-48pp-52gr

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of…

Priority LOW 35CWE-502Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-502.

Summary

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.

Why it matters now

EPSS 0.00734 54th percentileScored 2026-11-07
Fix Fixed org.apache.spark:spark-core_2.11 (Maven): 2.1.2org.apache.spark:spark-core_2.10 (Maven): 2.1.2+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.apache.spark:spark-core_2.11 (Maven)before 2.1.22.1.2Patch availableGHSA-8rhc-48pp-52gr
—org.apache.spark:spark-core_2.10 (Maven)before 2.1.22.1.2Patch availableGHSA-8rhc-48pp-52gr
—pyspark (PyPI)before 2.1.22.1.2Patch availableGHSA-8rhc-48pp-52gr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-8rhc-48pp-52gr
  • org.apache.spark:spark-core_2.10 (Maven) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-8rhc-48pp-52gr
  • pyspark (PyPI) Vendor— Affected before 2.1.2 Fixed in 2.1.2 Patch available GHSA-8rhc-48pp-52gr

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:1.6.0:*:*:*:*:*:*:*1.6.0VulnerableApache
cpe:2.3:a:apache:spark:1.6.1:*:*:*:*:*:*:*1.6.1VulnerableApache
cpe:2.3:a:apache:spark:1.6.2:*:*:*:*:*:*:*1.6.2VulnerableApache
cpe:2.3:a:apache:spark:1.6.3:*:*:*:*:*:*:*1.6.3VulnerableApache
cpe:2.3:a:apache:spark:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:a:apache:spark:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableApache
cpe:2.3:a:apache:spark:2.0.2:*:*:*:*:*:*:*2.0.2VulnerableApache
cpe:2.3:a:apache:spark:2.1.0:*:*:*:*:*:*:*2.1.0VulnerableApache
cpe:2.3:a:apache:spark:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableApache
  • cpe:2.3:a:apache:spark:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-8rhc-48pp-52gr org.apache.spark:spark-core_2.11 (Maven) Fixed in 2.1.2 Advisory →
  • Fix · GHSA-8rhc-48pp-52gr org.apache.spark:spark-core_2.10 (Maven) Fixed in 2.1.2 Advisory →
  • Fix · GHSA-8rhc-48pp-52gr pyspark (PyPI) Fixed in 2.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12612
  2. 2026-10-03 Alias added: GHSA-8rhc-48pp-52gr

References

Advisory 2

Other 1

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences