Vulnerabilities Issues in Spark 3.4.0

[Atul Kumar <at...@perforce.com.INVALID>]

Hello Team,

I'm hoping all is okay with you. To put things in perspective, one of our solutions offloads massive volumes of data and then loads it back into the database using the Apache Spark (3.4.0)<https://spark.apache.org/docs/3.4.0/> and MS Spark connection<https://learn.microsoft.com/en-us/sql/connect/spark/connector?view=sql-server-ver16>.
We discovered that Apache Spark and its transitive dependencies have numerous security vulnerabilities, the majority of which we are unable to eliminate as being in a shaded jar.

Please share your opinions with us regarding these security flaws and how you intend to address them in a future release or with a patch for an existing one.

Please locate the attached XLS sheet of vulnerabilities for your reference.

--
Thanks,
Atul Kumar | DELPHIX


This e-mail may contain information that is privileged or confidential. If you are not the intended recipient, please delete the e-mail and any attachments and notify us immediately.