You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spark.apache.org by "miqowhy (via GitHub)" <gi...@apache.org> on 2026/03/24 06:04:42 UTC
[PR] Document new security vulnerability in Apache Spark [spark-website]
miqowhy opened a new pull request, #683:
URL: https://github.com/apache/spark-website/pull/683
Added details about CVE-2025-55039 vulnerability in Apache Spark, including severity, affected versions, descriptions, mitigations, and credit.
Two remarks:
- I've taken the affected versions from [Holden's description](https://lists.apache.org/thread/zrgyy9l85nm2c7vk36vr7bkyorg3w4qq), but I think all newer versions are also affected
- For Holden's 2nd mitigation - I think setting spark.ssl.enabled=true is not enough, you also need spark.ssl.rpc.enabled=true, at least that's what the [documentation](https://spark.apache.org/docs/latest/security.html#ssl-configuration) says
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "miqowhy (via GitHub)" <gi...@apache.org>.
miqowhy commented on PR #683:
URL: https://github.com/apache/spark-website/pull/683#issuecomment-4124051355
> Thanks for adding this! There's a build step you need to follow the for website changes to be visible.
I've run the build step now, hope this is enough
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "miqowhy (via GitHub)" <gi...@apache.org>.
miqowhy commented on PR #683:
URL: https://github.com/apache/spark-website/pull/683#issuecomment-4118106874
Thanks for the reply, I'll follow the build step.
But in parallel I think we need to clarify the affected versions - I'll be reproducing the CVE to check, but is there any reason why newer versions are not affected by this vulnerability?
Looking at the docs of the latest version it looks like the vulnerable default is still in place.
Or am I missing something?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "miqowhy (via GitHub)" <gi...@apache.org>.
miqowhy commented on PR #683:
URL: https://github.com/apache/spark-website/pull/683#issuecomment-4144380918
Anything preventing us from merging? @holdenk @pan3793
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #683:
URL: https://github.com/apache/spark-website/pull/683#issuecomment-4115673058
Thanks for adding this! There's a build step you need to follow the for website changes to be visible.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "pan3793 (via GitHub)" <gi...@apache.org>.
pan3793 commented on code in PR #683:
URL: https://github.com/apache/spark-website/pull/683#discussion_r2985400057
##########
security.md:
##########
@@ -58,6 +58,30 @@ This includes verifying the source, validating integrity, and applying appropria
before loading or deploying a model.
<h2>Known security issues</h2>
+<h3 id="CVE-2025-55039">CVE-2025-55039: Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks</h3>
Review Comment:
nit: a new line between <h2> <h3>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "holdenk (via GitHub)" <gi...@apache.org>.
holdenk commented on PR #683:
URL: https://github.com/apache/spark-website/pull/683#issuecomment-4123298438
So I think https://issues.apache.org/jira/browse/SPARK-47172 indicates that the new config option is recommended for the new versions which if you follow the guidance in security settings is secure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org
Re: [PR] Document new security vulnerability in Apache Spark [spark-website]
Posted by "asf-gitbox-commits (via GitHub)" <gi...@apache.org>.
asf-gitbox-commits closed pull request #683: Document new security vulnerability in Apache Spark
URL: https://github.com/apache/spark-website/pull/683
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@spark.apache.org
For additional commands, e-mail: commits-help@spark.apache.org