Riskcovery

CVE-2021-38296

Apache Spark Key Negotiation Vulnerability

State
Published
Severity
Not scored
Published
Mar 10, 2022
Updated
Aug 4, 2024
Reserved
Aug 9, 2021

Read the record on cve.org

Description

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

Scores

The record has no CVSS score.

Weaknesses

  • CWE-294 Authentication Bypass by Capture-replay

Affected Products

ProductVersions
Apache SparkApache Software Foundation
  • up to and including version 3.1.2 through 3.1.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.