{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"low"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"SUSE CVE-2018-8024","title":"Title"},{"category":"description","text":"In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.","title":"Description of the CVE"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"CVE-2018-8024","url":"https://www.suse.com/security/cve/CVE-2018-8024"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1101308 for CVE-2018-8024","url":"https://bugzilla.suse.com/1101308"}],"title":"SUSE CVE CVE-2018-8024","tracking":{"current_release_date":"2025-04-05T02:52:20Z","generator":{"date":"2023-02-15T04:29:18Z","engine":{"name":"cve-database.git:bin/generate-csaf-vex.pl","version":"1"}},"id":"CVE-2018-8024","initial_release_date":"2023-02-15T04:29:18Z","revision_history":[{"date":"2023-02-15T04:29:18Z","number":"2","summary":"Current version"},{"date":"2025-01-01T07:48:28Z","number":"3","summary":"Current version"},{"date":"2025-02-18T07:09:47Z","number":"4","summary":"Current version"},{"date":"2025-03-14T04:07:48Z","number":"5","summary":"Current version"},{"date":"2025-03-15T12:27:24Z","number":"6","summary":"Current version"},{"date":"2025-04-05T02:52:20Z","number":"7","summary":"Current version"}],"status":"interim","version":"7"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"HPE Helion OpenStack 8","product":{"name":"HPE Helion OpenStack 8","product_id":"HPE Helion OpenStack 8","product_identification_helper":{"cpe":"cpe:/o:suse:hpe-helion-openstack:8"}}},{"category":"product_name","name":"SUSE Manager Server 3.0","product":{"name":"SUSE Manager Server 3.0","product_id":"SUSE Manager Server 3.0","product_identification_helper":{"cpe":"cpe:/o:suse:suse-manager-server:3.0"}}},{"category":"product_name","name":"SUSE Manager Server 3.1","product":{"name":"SUSE Manager Server 3.1","product_id":"SUSE Manager Server 3.1","product_identification_helper":{"cpe":"cpe:/o:suse:suse-manager-server:3.1"}}},{"category":"product_name","name":"SUSE OpenStack Cloud 8","product":{"name":"SUSE OpenStack Cloud 8","product_id":"SUSE OpenStack Cloud 8","product_identification_helper":{"cpe":"cpe:/o:suse:suse-openstack-cloud:8"}}},{"category":"product_name","name":"SUSE OpenStack Cloud Crowbar 8","product":{"name":"SUSE OpenStack Cloud Crowbar 8","product_id":"SUSE OpenStack Cloud Crowbar 8","product_identification_helper":{"cpe":"cpe:/o:suse:suse-openstack-cloud-crowbar:8"}}},{"category":"product_version","name":"spark","product":{"name":"spark","product_id":"spark","product_identification_helper":{"cpe":"cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*","purl":"pkg:rpm/suse/spark@?upstream=spark.src.rpm"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"spark as component of HPE Helion OpenStack 8","product_id":"HPE Helion OpenStack 8:spark"},"product_reference":"spark","relates_to_product_reference":"HPE Helion OpenStack 8"},{"category":"default_component_of","full_product_name":{"name":"spark as component of SUSE Manager Server 3.0","product_id":"SUSE Manager Server 3.0:spark"},"product_reference":"spark","relates_to_product_reference":"SUSE Manager Server 3.0"},{"category":"default_component_of","full_product_name":{"name":"spark as component of SUSE Manager Server 3.1","product_id":"SUSE Manager Server 3.1:spark"},"product_reference":"spark","relates_to_product_reference":"SUSE Manager Server 3.1"},{"category":"default_component_of","full_product_name":{"name":"spark as component of SUSE OpenStack Cloud 8","product_id":"SUSE OpenStack Cloud 8:spark"},"product_reference":"spark","relates_to_product_reference":"SUSE OpenStack Cloud 8"},{"category":"default_component_of","full_product_name":{"name":"spark as component of SUSE OpenStack Cloud Crowbar 8","product_id":"SUSE OpenStack Cloud Crowbar 8:spark"},"product_reference":"spark","relates_to_product_reference":"SUSE OpenStack Cloud Crowbar 8"}]},"vulnerabilities":[{"cve":"CVE-2018-8024","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2018-8024"}],"notes":[{"category":"general","text":"In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.","title":"CVE description"}],"product_status":{"known_affected":["HPE Helion OpenStack 8:spark","SUSE OpenStack Cloud 8:spark","SUSE OpenStack Cloud Crowbar 8:spark"],"known_not_affected":["SUSE Manager Server 3.0:spark","SUSE Manager Server 3.1:spark"]},"references":[{"category":"external","summary":"CVE-2018-8024","url":"https://www.suse.com/security/cve/CVE-2018-8024"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1101308 for CVE-2018-8024","url":"https://bugzilla.suse.com/1101308"}],"threats":[{"category":"impact","date":"2018-07-12T11:47:53Z","details":"low"}],"title":"CVE-2018-8024"}]}