Arbitrary Command Execution Affecting org.apache.spark:spark-core_2.12 package, versions [,3.1.3) [3.2.0,3.2.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGAPACHESPARK-2432301
- published 24 Mar 2022
- disclosed 24 Mar 2022
- credit Hyukjin Kwon
How to fix?
Upgrade org.apache.spark:spark-core_2.12 to version 3.1.3, 3.2.2 or higher.
Overview
org.apache.spark:spark-core_2.12 is an unified analytics engine for large-scale data processing. It provides high-level APIs in Scala, Java, Python, and R, and an optimized engine that supports general computation graphs for data analysis. It also supports a rich set of higher-level tools including Spark SQL for SQL and DataFrames, pandas API on Spark for pandas workloads, MLlib for machine learning, GraphX for graph processing, and Structured Streaming for stream processing.
Affected versions of this package are vulnerable to Arbitrary Command Execution via the Utils.unpack method when the filename is controlled by a malicious user. This vulnerability exists due to Hadoop's unTar function, that doesn't properly escape the filename before passing it to a shell command.