Detections
Analytics

SCA: security update for apache-airflow-providers-apache-spark (GHSA-8q28-pw9g-w82c)

high Tenable Self-Hosted Container Security Plugin ID 421606

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability
 in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed
 on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run
 arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3,
 this was not called out in the documentation explicitly, so it is possible that administrators provided
 authorizations to configure Spark hooks without taking this into account. We recommend administrators to
 review their configurations to make sure the authorization to configure Spark hooks is only provided to
 fully trusted users. To view the warning in the docs please visit https://airflow.apache.org/docs/apache-
 airflow-providers-apache-spark/4.1.3/connections/spark.html (CVE-2023-40195)

See Also

https://github.com/advisories/GHSA-8q28-pw9g-w82c

Plugin Details

Severity: High

ID: 421606

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 3/28/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.58

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2023-40195

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/28/2023

Vulnerability Publication Date: 8/28/2023

Reference Information

CVE: CVE-2023-40195

cwe: CWE-502