CVE-2021-38296

Katalog CVE

CVSS 7.5 · High EPSS 1,8%

Kerentanan Authentication Bypass by Capture-replay pada apache spark, oracle financial services crime and compliance management studio. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

Rincian

Terbit di NVD

10 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 78,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd mailing list · advisory vendor
• https://www.oracle.com/security-alerts/cpujul2022.html patch · advisory pihak ketiga