CVE-2021-38296: apache software foundation apache spark Authentication Bypass by Capture-replay

Vulnerability summary

CVE-2021-38296 is a high (CVSS 7.5) Authentication Bypass by Capture-replay vulnerability in apache software foundation apache spark. EPSS estimates a 1.85% chance of exploitation in the next 30 days, higher than 78.6% of scored vulnerabilities.

Timeline

1. 10-03-2022
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

• CWE-294Authentication Bypass by Capture-replayA capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).