description: In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application.
problem types: Information Disclosure
affected:
{
product: Apache Spark
vendor: Apache Software Foundation
versions:
status: affected, version: 1.0.0 to 2.1.2
status: affected, version: 2.2.0 to 2.2.1
status: affected, version: 2.3.0
}