CVE-2021-38296

Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and "spark.network.crypto.enabled". In versions 3.1.2 and earlier, it uses a bespoke mutual authentication protocol that allows for full encryption key recovery. After an initial interactive attack, this would allow someone to decrypt plaintext traffic offline. Note that this does not affect security mechanisms controlled by "spark.authenticate.enableSaslEncryption", "spark.io.encryption.enabled", "spark.ssl", "spark.ui.strictTransportSecurity". Update to Apache Spark 3.1.3 or later

• CWE-294
• CWE-294

• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smdMailing List, Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory
• https://lists.apache.org/thread/70x8fw2gx3g9ty7yk0f2f1dlpqml2smdMailing List, Vendor Advisory
• https://www.oracle.com/security-alerts/cpujul2022.htmlPatch, Third Party Advisory

Published

Mar 10, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-38289An issue has been discovered in Novastar-VNNOX-iCare Novaica…8.8
• CVE-2021-3829openwhyd is vulnerable to URL Redirection to Untrusted Site6.1
• CVE-2021-38290A host header attack vulnerability exists in FUEL CMS 1.5.0 …8.1
• CVE-2021-38291FFmpeg version (git commit de8e6e67e7523e48bb27ac224a0b446df…7.5
• CVE-2021-38294A Command Injection vulnerability exists in the getTopologyH…9.8
• CVE-2021-38295In Apache CouchDB, a malicious user with permission to creat…7.3
• CVE-2021-38297Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overf…9.8
• CVE-2021-38298Zoho ManageEngine ADManager Plus before 7110 is vulnerable t…9.8
• CVE-2021-38299Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access C…9.8
• CVE-2021-3830btcpayserver is vulnerable to Improper Neutralization of Inp…5.4
• CVE-2021-38300arch/mips/net/bpf_jit.c in the Linux kernel before 5.4.10 ca…7.8
• CVE-2021-38302The Newsletter extension through 4.0.0 for TYPO3 allows SQL …9.8