CVE-2023-22946
Description
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.
How to fix
- apache spark3.4.0 or later
- org.apache.spark:spark-core_2.123.3.3 or later
- org.apache.spark:spark-core_2.133.3.3 or later
- pyspark3.3.2, 3.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache spark | v < 3.4.0 | 3.4.0 |
| org.apache.spark:spark-core_2.12Maven | v < 3.3.3 | 3.3.3 |
| org.apache.spark:spark-core_2.13Maven | v < 3.3.3 | 3.3.3 |
| pysparkPyPI | v < 3.3.2, v < 3.4.0 | 3.3.2, 3.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.