[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAEccTyzwkSJ-2ebKLsxTfu7A60ut5rv8eRoWe7LM7oFv1GXEuQ@mail.gmail.com>
Date: Wed, 24 Oct 2018 11:30:21 -0500
From: Sean Owen <srowen@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2018-11804: Apache Spark build/mvn runs zinc, and can expose
information from build machines
Severity: Low
Vendor: The Apache Software Foundation
Versions Affected:
1.3.x release branch and later, including master
Description:
Spark's Apache Maven-based build includes a convenience script, 'build/mvn',
that downloads and runs a zinc server to speed up compilation. This server
will accept connections from external hosts by default. A specially-crafted
request to the zinc server could cause it to reveal information in files
readable to the developer account running the build. Note that this issue
does not affect end users of Spark, only developers building Spark from
source code.
Mitigation:
Spark users are not affected, as zinc is only a part of the build process.
Spark developers may simply use a local Maven installation's 'mvn' command
to build, and avoid running build/mvn and zinc.
Spark developers building actively-developed branches (2.2.x, 2.3.x, 2.4.x,
master) may update their branches to receive mitigations already patched
onto the build/mvn script.
Spark developers running zinc separately may include "-server 127.0.0.1" in
its command line, and consider additional flags like "-idle-timeout 30m" to
achieve similar mitigation.
Credit:
Andre Protas, Apple Information Security
References:
https://spark.apache.org/security.html
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
