6.4
Moyenne
CVE-2023-22946 In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
Description
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Apache Spark 3.4 | premières → < 3.4.0 | 3.4.0 |
Références
- lists.apache.org lists.apache.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Apache Spark
Les 16 CVE de Apache Spark →
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
Non notée
CVE-2025-54920
This issue affects Apache Spark: before 3.5.7 and 4.0.1
Non notée
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
Non notée
CVE-2024-23945
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
Non notée