Improper Privilege Management Affecting org.apache.spark:spark-core_2.12 package, versions [,3.3.3)


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.1% (43rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Privilege Management vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-JAVA-ORGAPACHESPARK-5425123
  • published17 Apr 2023
  • disclosed17 Apr 2023
  • creditHideyuki Furue, Yi Wu

Introduced: 17 Apr 2023

CVE-2023-22946  (opens in a new tab)
CWE-269  (opens in a new tab)

How to fix?

Upgrade org.apache.spark:spark-core_2.12 to version 3.3.3 or higher.

Overview

org.apache.spark:spark-core_2.12 is an unified analytics engine for large-scale data processing. It provides high-level APIs in Scala, Java, Python, and R, and an optimized engine that supports general computation graphs for data analysis. It also supports a rich set of higher-level tools including Spark SQL for SQL and DataFrames, pandas API on Spark for pandas workloads, MLlib for machine learning, GraphX for graph processing, and Structured Streaming for stream processing.

Affected versions of this package are vulnerable to Improper Privilege Management when applications using spark-submit can specify a proxy-user to run with limiting privileges., which allows the application to execute code with the privileges of the submitting user. Exploiting this vulnerability is possible by providing malicious configuration-related classes on the classpath.

Note: This vulnerability affects architectures relying on proxy-user, for example, those using Apache Livy to manage submitted applications.

Mitigation

After upgrading to the fixed version - ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false" and is not overridden by submitted applications.

CVSS Scores

version 3.1