CVE-2023-22946
Apache Spark proxy-user privilege escalation from malicious configuration class
Description
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.
How to fix CVE-2023-22946
To remediate CVE-2023-22946, upgrade the affected package to a fixed version below.
- —upgrade to 3.4.0 or later
- —upgrade to 3.3.3 or later
- —upgrade to 3.3.3 or later
- —upgrade to 3.3.2 or later
- —upgrade to 3.4.0 or later
Is CVE-2023-22946 being exploited?
Low — EPSS is 1.1%, meaning exploitation activity has not been observed at scale.
Affected packages (5)
- from 0, < 3.4.0
- from 0, < 3.3.3
- from 0, < 3.3.3
- from 0, < 3.3.2
- from 0, < 3.4.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |