CVE-2023-22946: Apache Spark vulnerable to Improper Privilege Management
(updated )
In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a proxy-user to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.
Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of “false”, and is not overridden by submitted applications.
References
- github.com/advisories/GHSA-329j-jfvr-rhr6
- github.com/apache/spark
- github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
- github.com/apache/spark/pull/39474
- github.com/apache/spark/pull/41428
- github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
- issues.apache.org/jira/browse/SPARK-41958
- lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
- nvd.nist.gov/vuln/detail/CVE-2023-22946
Detect and mitigate CVE-2023-22946 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →