Skip to content
Heist/ feed
Back to feed
Critical

Security advisory

Type: advisorySources: OSVCVE: CVE-2020-9480

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2020-9480
Confirmed fixed CVEs
Not specified
Updated in this feed
1 Nov 2026, 06:16 UTC · Revision 1

Source evidence

CVE-2020-9480

core-osv · Original source

Published 23 Jun 2020, 22:15 UTC

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).

osv:CVE-2020-9480
Complete source record
{
  "id": "f2ea7c6f9e6bf4248a3c4e29ae654573c6b4ed6187f9b9cd8c4a7008cf0b64f6",
  "url": "https://osv.dev/vulnerability/CVE-2020-9480",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2020-9480",
    "summary": "In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).",
    "evidence": "osv:CVE-2020-9480",
    "products": [],
    "severity": "critical",
    "structured": {
      "id": "CVE-2020-9480",
      "aliases": [
        "BIT-spark-2020-9480",
        "CVE-2020-9480",
        "GHSA-wgx7-jwwm-cgjv",
        "PYSEC-2020-95"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/apache/spark",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "cee4ecbb16917fa85f02c635925e2687400aa56b"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.4.5"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.4.5-rc2",
            "v2.4.5",
            "v2.4.5-rc1",
            "v2.4.4-rc3",
            "v2.4.4",
            "v2.4.4-rc2",
            "v2.4.4-rc1",
            "v2.4.3-rc1",
            "v2.4.3",
            "v2.4.2-rc1",
            "v2.4.2",
            "v2.4.1-rc9",
            "v2.4.1",
            "v2.4.1-rc8",
            "v2.4.1-rc7",
            "v2.4.1-rc5",
            "v2.4.1-rc4",
            "v2.4.1-rc3",
            "v2.4.1-rc2",
            "v2.4.1-rc1",
            "v2.4.0-rc5",
            "v2.4.0",
            "v2.4.0-rc4",
            "v2.4.0-rc3",
            "v2.4.0-rc2",
            "v2.4.0-rc1",
            "v0.7.0",
            "v0.6.0",
            "0.3-scala-2.8",
            "alpha-0.2"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-9480.json"
          }
        }
      ],
      "modified": "2026-10-24T10:30:37.560080535Z",
      "provider": "osv",
      "references": [
        "https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3E",
        "https://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3E",
        "https://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3E",
        "https://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3E",
        "https://spark.apache.org/security.html#CVE-2020-9480",
        "https://www.oracle.com/security-alerts/cpuApr2021.html"
      ],
      "provider_metadata": {
        "unresolved_ranges": [
          {
            "cpes": [
              "cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*"
            ],
            "vendor_product": "oracle:business_intelligence",
            "extracted_events": [
              {
                "range": [
                  {
                    "introduced": "5.5.0.0.0"
                  },
                  {
                    "last_affected": "5.5.0.0.0"
                  }
                ],
                "source": "CPE_STRING"
              }
            ]
          }
        ]
      }
    },
    "related_cves": [
      {
        "value": "CVE-2020-9480",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 434249,
  "published_at": "2020-06-23T22:15:14.137+00:00"
}