Cleartext storage of sensitive information in Apache Spark
Priority LOW 35CWE-312Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-312.
Summary
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Why it matters now
EPSS 0.01308 70th percentileScored 2026-11-07
Fix Fixed org.apache.spark:spark-core_2.11 (Maven): 2.3.3pyspark (PyPI): 2.3.3
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Spark | up to 2.3.2 | — | No fix listed | CNA |
| — | org.apache.spark:spark-core_2.11 (Maven) | before 2.3.3 | 2.3.3 | Patch available | GHSA-fp5j-3fpf-mhj5 |
| — | pyspark (PyPI) | before 2.3.3 | 2.3.3 | Patch available | GHSA-fp5j-3fpf-mhj5 |
- Apache Spark VendorApache Affected up to 2.3.2 Fixed in — No fix listed CNA
- org.apache.spark:spark-core_2.11 (Maven) Vendor— Affected before 2.3.3 Fixed in 2.3.3 Patch available GHSA-fp5j-3fpf-mhj5
- pyspark (PyPI) Vendor— Affected before 2.3.3 Fixed in 2.3.3 Patch available GHSA-fp5j-3fpf-mhj5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* | 1.0.2 – 1.6.3; 2.0.0 – 2.0.2; 2.1.0 – 2.1.3; 2.2.0 – 2.2.2; 2.3.0 to before 2.3.2 | Vulnerable | Apache |
- cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions 1.0.2 – 1.6.3; 2.0.0 – 2.0.2; 2.1.0 – 2.1.3; 2.2.0 – 2.2.2; 2.3.0 to before 2.3.2 Vulnerable ·Apache
Remediation
- Fix · GHSA-fp5j-3fpf-mhj5 org.apache.spark:spark-core_2.11 (Maven) Fixed in 2.3.3 Advisory →
- Fix · GHSA-fp5j-3fpf-mhj5 pyspark (PyPI) Fixed in 2.3.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10099
- 2026-10-03 Alias added: GHSA-fp5j-3fpf-mhj5
References
Other 7
- https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e%40%3Cuser.spark.apache.org%3E
- [spark-issues] 20200318 [jira] [Commented] (SPARK-28626) Spark leaves unencrypted data on local disk, even with encryption turned on (CVE-2019-10099)
- [spark-commits] 20200622 [spark-website] branch asf-site updated: CVE-2020-9480 details (#275)
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-114.yaml
- https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E
- https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae@%3Ccommits.spark.apache.org%3E
- https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2@%3Cissues.spark.apache.org%3E
More Apache Spark vulnerabilities
- TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
- TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
- TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
- TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
- TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
- TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
Sources
- CVE-2019-10099 · CVE Program
- CVE-2019-10099 · NVD
- FIRST EPSS
- GHSA-fp5j-3fpf-mhj5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences