CVE-2019-10099 is a vulnerability in Apache Spark
Published on August 7, 2019
Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
Products Associated with CVE-2019-10099
Want to know whenever a new CVE is published for Apache Spark? stack.watch will email you.
Affected Versions
Apache Spark Version 2.3.2 and below is affected by CVE-2019-10099Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.