High severity7.8NVD Advisory· Published Sep 13, 2017· Updated May 13, 2026
CVE-2017-12612
CVE-2017-12612
Description
In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine. It does not affect apps run by spark-submit or spark-shell. The attacker would be able to execute code as the user that ran the Spark application. Users are encouraged to update to version 2.2.0 or later.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.spark:spark-core_2.11Maven | < 2.1.2 | 2.1.2 |
org.apache.spark:spark-core_2.10Maven | < 2.1.2 | 2.1.2 |
pysparkPyPI | < 2.1.2 | 2.1.2 |
Affected products
9cpe:2.3:a:apache:spark:2.0.2:*:*:*:*:*:*:*+ 8 more
- cpe:2.3:a:apache:spark:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:2.1.1:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
5- www.securityfocus.com/bid/100823nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-8rhc-48pp-52grghsaADVISORY
- mail-archives.apache.org/mod_mbox/spark-dev/201709.mbox/%3CCAEccTyy-1yYuhdNgkBUg0sr9NeaZSrBKkBePdTNZbxXZNTAR-g%40mail.gmail.com%3EnvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2017-12612ghsaADVISORY
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2017-147.yamlghsaWEB
News mentions
0No linked articles in our index yet.