{"id":"CVE-2019-10099","aliases":["GHSA-fp5j-3fpf-mhj5","PYSEC-2019-114"],"url":"https://o3.security/vulnerability/CVE-2019-10099","summary":"Sensitive data written to disk unencrypted in Spark","details":"Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.","published":"2019-08-07T17:15:12.073Z","modified":"2026-10-24T10:30:54.391216613Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.spark:spark-core_2.11","fixedVersion":"2.3.3"},{"ecosystem":"PyPI","name":"pyspark","fixedVersion":"2.3.3"}],"fix":null,"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e%40%3Cuser.spark.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae%40%3Ccommits.spark.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2%40%3Cissues.spark.apache.org%3E"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10099"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2019-114.yaml"},{"type":"WEB","url":"https://lists.apache.org/thread.html/c2a39c207421797f82823a8aff488dcd332d9544038307bf69a2ba9e@%3Cuser.spark.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ra216b7b0dd82a2c12c2df9d6095e689eb3f3d28164e6b6587da69fae@%3Ccommits.spark.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/rabe1d47e2bf8b8f6d9f3068c8d2679731d57fa73b3a7ed1fa82406d2@%3Cissues.spark.apache.org%3E"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:54.391216613Z"}}