CVE-2023-22946: Apache Spark vulnerable to Improper Privilege Management
(updated )
In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a proxy-user to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.
Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of “false”, and is not overridden by submitted applications.
References
- github.com/advisories/GHSA-329j-jfvr-rhr6
- github.com/apache/spark
- github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
- github.com/apache/spark/pull/39474
- github.com/apache/spark/pull/41428
- github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
- issues.apache.org/jira/browse/SPARK-41958
- lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
- nvd.nist.gov/vuln/detail/CVE-2023-22946
Code Behaviors & Features
Detect and mitigate CVE-2023-22946 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →