CVE-2018-11804 Details
Description
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to speed up compilation. It has been included in release branches since 1.3.x, up to and including master. This server will accept connections from external hosts by default. A specially-crafted request to the zinc server could cause it to reveal information in files readable to the developer account running the build. Note that this issue does not affect end users of Spark, only developers building Spark from source code.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.apache.org/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E | CVE | Mailing ListThird Party Advisory |
| https://spark.apache.org/security.html#CVE-2018-11804 | CVE | MitigationVendor Advisory |
| http://www.securityfocus.com/bid/105756 | CVE | Broken LinkThird Party AdvisoryVDB Entry |
| https://lists.apache.org/thread.html/2b11aa4201e36f2ec8f728e722fe33758410f07784379cbefd0bda9d%40%3Cdev.spark.apache.org%3E | [email protected] | Mailing ListThird Party Advisory |
| https://spark.apache.org/security.html#CVE-2018-11804 | [email protected] | MitigationVendor Advisory |
| http://www.securityfocus.com/bid/105756 | [email protected] | Broken LinkThird Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache spark | >= 1.3.0, < 2.2.3 >= 2.3.0, < 2.3.3 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| Jun 10, 2024 | Reanalysis | [email protected] |
| May 14, 2024 | CVE Modified | [email protected] |
| Jan 31, 2023 | Modified Analysis | [email protected] |
| Nov 22, 2022 | CVE Modified | [email protected] |
| Dec 11, 2018 | Initial Analysis | [email protected] |
| Oct 30, 2018 | CVE Modified | [email protected] |