Uploaded image for project: 'Spark'
  1. Spark
  2. SPARK-11652

Remote code execution with InvokerTransformer

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 1.4.2, 1.5.3, 1.6.0
    • Component/s: Spark Core
    • Labels:
      None

      Description

      There is a remote code execution vulnerability in the Apache Commons collections library (https://issues.apache.org/jira/browse/COLLECTIONS-580) that can be exploited simply by causing malicious data to be deserialized using Java serialization.

      As Spark is used in security-conscious environments I think it's worth taking a closer look at how the vulnerability affects Spark. What are the points where Spark deserializes external data? Which are affected by using Kryo instead of Java serialization? What mitigation strategies are available?

      If the issue is serious enough but mitigation is possible, it may be useful to post about it on the mailing list or blog.

      Thanks!

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                srowen Sean Owen
                Reporter:
                darabos Daniel Darabos
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved: