{"id":"GHSA-329j-jfvr-rhr6","summary":"Apache Spark vulnerable to Improper Privilege Management","details":"In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a `proxy-user` to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of \"false\", and is not overridden by submitted applications.","aliases":["BIT-spark-2023-22946","CVE-2023-22946","PYSEC-2023-44"],"modified":"2024-10-15T18:49:31.436249Z","published":"2023-04-17T09:30:23Z","database_specific":{"severity":"CRITICAL","cwe_ids":["CWE-269"],"github_reviewed_at":"2023-04-21T20:37:59Z","github_reviewed":true,"nvd_published_at":"2023-04-17T08:15:00Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22946"},{"type":"WEB","url":"https://github.com/apache/spark/pull/39474"},{"type":"WEB","url":"https://github.com/apache/spark/pull/41428"},{"type":"WEB","url":"https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a"},{"type":"WEB","url":"https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a"},{"type":"PACKAGE","url":"https://github.com/apache/spark"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml"},{"type":"WEB","url":"https://issues.apache.org/jira/browse/SPARK-41958"},{"type":"WEB","url":"https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv"}],"affected":[{"package":{"name":"org.apache.spark:spark-core_2.12","ecosystem":"Maven","purl":"pkg:maven/org.apache.spark/spark-core_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.0-preview","3.0.0-preview2","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-329j-jfvr-rhr6/GHSA-329j-jfvr-rhr6.json","last_known_affected_version_range":"\u003c= 3.3.2"}},{"package":{"name":"org.apache.spark:spark-core_2.13","ecosystem":"Maven","purl":"pkg:maven/org.apache.spark/spark-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2"],"database_specific":{"last_known_affected_version_range":"\u003c= 3.3.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-329j-jfvr-rhr6/GHSA-329j-jfvr-rhr6.json"}},{"package":{"name":"pyspark","ecosystem":"PyPI","purl":"pkg:pypi/pyspark"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}],"versions":["2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/04/GHSA-329j-jfvr-rhr6/GHSA-329j-jfvr-rhr6.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}