Safety vulnerability ID: 65465
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Version 0.2.0 of Spark-on-k8s updates its `aiohttp` dependency to require version 3.9.2 or newer. This change aims to protect against the potential security risks outlined in CVE-2024-23829.
Latest version: 0.12.0
A Python package to submit and manage Apache Spark applications on Kubernetes.
What's Changed
* Support creating an ephemeral secret for sensitive arguments (Python client, CLI, and Airflow operator)
* Support mounting existing secrets to the driver pod as environment variables (Python client and CLI)
* Support mounting volumes to the spark driver pod (Python client and Airflow operator)
* Support mounting volumes to the spark executor pods (Python client and Airflow operator)
Security
* Add a lower bound for `aiohttp` to avoid [CVE-2024-23829 ](https://github.com/advisories/GHSA-8qpw-xqxj-h4r2) and [CVE-2024-23334](https://github.com/advisories/GHSA-5h86-8mv2-jq9f)
* Bump `FastAPI` and `starlette` versions to fix [CVE-2024-24762](https://github.com/advisories/GHSA-2jv5-9r88-3w3p)
**Full Changelog**: https://github.com/hussein-awala/spark-on-k8s/compare/0.1.0...0.2.0
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application