Apache SparkGHSA-329j-jfvr-rhr6
Apache Spark vulnerable to Improper Privilege Management
Critical9.9CVE-2023-22946 · Published Apr 17, 2023 · updated Oct 15, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| org.apache.spark:spark-core_2.12 Maven | < 3.3.3 | 3.3.3 |
| org.apache.spark:spark-core_2.13 Maven | < 3.3.3 | 3.3.3 |
| pyspark PyPI | < 3.3.2 | 3.3.2 |
Details and references
In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a `proxy-user` to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-269
- Also known as
- BIT-spark-2023-22946, CVE-2023-22946, PYSEC-2023-44
- nvd.nist.gov/vuln/detail/CVE-2023-22946
- github.com/apache/spark/pull/39474
- github.com/apache/spark/pull/41428
- github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a
- github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a
- github.com/apache/spark
- github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml
- issues.apache.org/jira/browse/SPARK-41958
- lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
More Apache Spark advisories
All Apache Spark| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 22023 | Apache Spark UI vulnerable to Command Injection CVE-2023-32007High8.8fixed in 3.2.2 | High8.8 | 3.2.2 |
| Nov 12022 | Apache Spark vulnerable to Log Injection CVE-2022-31777Medium5.4fixed in 3.2.2, 3.3.1 | Medium5.4 | 3.2.2, 3.3.1 |
| Jul 192022 | Apache Spark UI can allow impersonation if ACLs enabled CVE-2022-33891High8.8fixed in 3.1.3, 3.2.2 | High8.8 | 3.1.3, 3.2.2 |
| Mar 112022 | Authentication Bypass by Capture-replay in Apache Spark CVE-2021-38296High7.5fixed in 3.1.3 | High7.5 | 3.1.3 |
| Feb 102022 | Improper Authentication in Apache Spark CVE-2020-9480Critical9.8fixed in 2.4.6 | Critical9.8 | 2.4.6 |
| Oct 152025 | Apache Spark has Inadequate Encryption Strength CVE-2025-55039Lowfixed in 3.4.4, 3.5.2 | Low | 3.4.4, 3.5.2 |