CVE-2023-22946
CVSS V2 None
CVSS V3 None
Description
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.
Update to Apache Spark 3.4.0 or later, and ensure that
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its
default of "false", and is not overridden by submitted applications.
Overview
- CVE ID
- CVE-2023-22946
- Assigner
- security@apache.org
- Vulnerability Status
- Analyzed
- Published Version
- 2023-04-17T08:15:07
- Last Modified Date
- 2023-04-26T23:00:56
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* | 1 | OR | 3.4.0 |
References
| Reference URL | Reference Tags |
|---|---|
| https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-22946 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22946 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2023-04-17 10:00:18 | Added to TrackCVE | |||
| 2023-04-17 10:00:19 | Weakness Enumeration | new | ||
| 2023-04-17 14:02:10 | 2023-04-17T13:12:43 | CVE Modified Date | updated | |
| 2023-04-17 14:02:10 | Received | Awaiting Analysis | Vulnerability Status | updated |
| 2023-04-21 13:00:41 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |
| 2023-04-27 00:01:14 | 2023-04-26T23:00:56 | CVE Modified Date | updated | |
| 2023-04-27 00:01:14 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
| 2023-04-27 00:01:16 | CPE Information | updated |