In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require
    authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to
    the master can succeed in starting an application's resources on the Spark cluster, even without the
    shared key. This can be leveraged to execute shell commands on the host machine. This does not affect
    Spark clusters using other resource managers (YARN, Mesos, etc). (CVE-2020-9480)

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). 

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Business Intelligence Publisher or Oracle Analytics Server 5.5 running on the remote host is 11.1.1.9.x prior to 11.1.1.9.210215, 12.2.1.3.x prior to 12.2.1.3.210405, 12.2.1.4.x prior to 12.2.1.4.210402, or 12.2.5.5.x (OAS 5.5) prior to 12.2.5.5.210331. It is, therefore, affected by multiple vulnerabilities as noted in the April 2021 Critical Patch Update advisory, including the following:

  - An unspecified vulnerability exists in the Analytics Server component of Oracle BI Enterprise Edition     subcomponent Apache Spark. An unauthenticated, remote attacker can exploit this, via HTTP, to take over     Oracle BI Enterprise Edition. (CVE-2020-9480)

  - A denial of service vulnerability exists in the BI Platform Security component of Oracle BI Enterprise     Edition subcomponent OpenSSL. An unauthenticated, remote attacker can exploit this, via HTTPS, to hang or     repeatedly crash the product. (CVE-2020-1971)

  - An unspecified vulnerability exists in the BI Platform Security component of Oracle BI Enterprise Edition     subcomponent Apache Tomcat.  An unauthenticated, remote attacker can exploit this, via HTTP, to result in     unauthorized update, insert, or delete access to some of Oracle BI accessible data, as well as     unauthorized read access to a subset of Oracle BI accessible data. (CVE-2019-0221)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
419928	SCA: security update for org.apache.spark:spark-parent_2.11, pyspark (GHSA-wgx7-jwwm-cgjv)	Tenable Cloud Security	SCA Checks	critical
419928	SCA: security update for org.apache.spark:spark-parent_2.11, pyspark (GHSA-wgx7-jwwm-cgjv)	Tenable Self-Hosted Container Security	SCA Checks	critical
172445	Apache Spark < 2.4.6 RCE (CVE-2020-9480)	Nessus	Misc.	critical
148980	Oracle Business Intelligence Publisher Multiple Vulnerabilities (Apr 2021 CPU)	Nessus	Misc.	critical

Detections

Analytics

CVE-2020-9480

critical

Tenable Plugins

critical

critical

critical

critical