==================================================================== CERT-Renater Note d'Information No. 2018/VULN339 _____________________________________________________________________ DATE : 26/10/2018 HARDWARE PLATFORM(S): / OPERATING SYSTEM(S): Systems running Apache Spark versions 1.3.x release branch and later. ===================================================================== https://spark.apache.org/security.html _____________________________________________________________________ Severity: Low Vendor: The Apache Software Foundation Versions Affected: 1.3.x release branch and later, including master Description: Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code. Mitigation: Spark users are not affected, as zinc is only a part of the build process. Spark developers may simply use a local Maven installation's 'mvn' command to build, and avoid running build/mvn and zinc. Spark developers building actively-developed branches (2.2.x, 2.3.x, 2.4.x, master) may update their branches to receive mitigations already patched onto the build/mvn script. Spark developers running zinc separately may include "-server 127.0.0.1" in its command line, and consider additional flags like "-idle-timeout 30m" to achieve similar mitigation. Credit: Andre Protas, Apple Information Security References: https://spark.apache.org/security.html ========================================================= + CERT-RENATER | tel : 01-53-94-20-44 + + 23/25 Rue Daviel | fax : 01-53-94-20-41 + + 75013 Paris | email:cert@support.renater.fr + =========================================================