We are getting following vulnerability in our security scan, for apache spark.
https://nvd.nist.gov/vuln/detail/CVE-2020-27216
spark-core_2.12-3.0.1.jar (shaded: org.eclipse.jetty:jetty-server:9.4.18.v20190429)
Can't exclude and include the latest jetty jars, as spark is using it as shaded jar. Also did not found the same vulnerability mentioned in anywhere for apache spark. Following are the links i checked.
https://www.cvedetails.com/vulnerability-list/vendor_id-45/product_id-38954/Apache-Spark.html https://spark.apache.org/security.html
Want to know if this is false alarm for spark or spark implemented the workaround for this. ??
Update:
Get to know, Spark is not doing unpacking of any web app. Hence issue is not present in Spark. But using vulnerable jar is not a good idea, hence spark is updating the jar version in upcoming release. Spark ticket for jar upgrade. issues.apache.org/jira/browse/SPARK-33831
Thanks
Thanks in advance.