CVE-2025-55039 (CNNVD-202510-2209)
中文标题:
Apache Spark 安全漏洞
英文标题:
Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks
漏洞描述
中文描述:
Apache Spark是美国阿帕奇（Apache）基金会的一款支持非循环数据流和内存计算的大规模数据处理引擎。 Apache Spark 3.4.4之前版本、3.5.2之前版本和4.0.0之前版本存在安全漏洞，该漏洞源于使用不安全的默认网络加密密码进行节点间RPC通信，可能导致中间人攻击修改加密RPC流量。
英文描述:
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0. Apache Spark versions before 4.0.0, 3.5.2 and 3.4.4 use an insecure default network encryption cipher for RPC communication between nodes. When spark.network.crypto.enabled is set to true (it is set to false by default), but spark.network.crypto.cipher is not explicitly configured, Spark defaults to AES in CTR mode (AES/CTR/NoPadding), which provides encryption without authentication. This vulnerability allows a man-in-the-middle attacker to modify encrypted RPC traffic undetected by flipping bits in ciphertext, potentially compromising heartbeat messages or application data and affecting the integrity of Spark workflows. To mitigate this issue, users should either configure spark.network.crypto.cipher to AES/GCM/NoPadding to enable authenticated encryption or enable SSL encryption by setting spark.ssl.enabled to true, which provides stronger transport security.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Apache Software Foundation | Apache Spark | - | < 3.5.2 | - |
cpe:2.3:a:apache_software_foundation:apache_spark:*:*:*:*:*:*:*:*
|
| apache | spark | * | - | - |
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
3.1 (adp)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-55039 |
2025-11-11 15:23:29 | 2025-11-11 07:40:43 |
| NVD | nvd_CVE-2025-55039 |
2025-11-11 15:01:06 | 2025-11-11 07:48:30 |
| CNNVD | cnnvd_CNNVD-202510-2209 |
2025-11-11 15:12:29 | 2025-11-11 08:00:17 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202510-2209
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 4 -> 2
- references_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']