[GitHub] [spark-website] srowen commented on a change in pull request #209: CVE-2019-10099

[GitBox <gi...@apache.org>]

srowen commented on a change in pull request #209: CVE-2019-10099
URL: https://github.com/apache/spark-website/pull/209#discussion_r310647817
 
 

 ##########
 File path: security.md
 ##########
 @@ -18,6 +18,31 @@ non-public list that will reach the Apache Security team, as well as the Spark P
 
 <h2>Known Security Issues</h2>
 
+<h3 id="CVE-2019-10099">CVE-2019-10099: Apache Spark unencrypted data on local disk</h3>
+
+Severity: Important
+
+Vendor: The Apache Software Foundation
+
+Versions affected:
+- All Spark 1.x, Spark 2.0.x, Spark 2.1.x, and 2.2.x versions
+- Spark 2.3.0 to 2.3.2
+
+Description:
+
+Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if `spark.io.encryption.enabled=true`.  This includes cached blocks that are fetched to disk (controlled by `spark.maxRemoteBlockSizeFetchToMem`); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.
+
+
+Mitigation:
+
+- 1.x, 2.0.x, 2.1.x, 2.2.x, 2.3.x  users should upgrade to 2.3.3 or newer
+- 2.3.x users should upgrade to 2.3.3 or newer.
 
 Review comment:
   I think this line is redundant? And above could simply say "Users of versions before 2.3.3 should upgrade to 2.3.3 or later, including 2.4.x". (Right? it's mitigated in 2.4.0?) Just to avoid confusion about whether 2.4.0 is 'newer' as I think it came before 2.3.3. Or else clarify what 2.4.x version is required for 2.4.x users.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org