What’s Vulnerable › Vulnerabilities

CVE-2021-38296: Apache Spark Key Negotiation Vulnerability

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-10 · updated 2026-06-17
• Weakness: CWE-294

Description

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

Affected products

• Apache Software Foundation Apache Spark: before 3.1.3 — fixed in 3.1.3
• Oracle Financial Services Crime And Compliance Management Studio: 8.0.8.2.0, 8.0.8.3.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Spark 3.1.3. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smd
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2021-38296 or the next vulnerability affects your stack