CVE-2023-22946 (Critical) detected in spark-core_2.11-2.2.3.jar

[mend-for-github-com]

CVE-2023-22946 - Critical Severity Vulnerability

Vulnerable Library - spark-core_2.11-2.2.3.jar

The Apache Software Foundation provides support for the Apache community of open-source software projects. The Apache projects are characterized by a collaborative, consensus based development process, an open and pragmatic software license, and a desire to create high quality software that leads the way in its field. We consider ourselves not simply a group of projects sharing a server, but rather a community of developers and users.

Library home page: http://spark.apache.org/

Path to dependency file: /build.gradle

Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/org.apache.spark/spark-core_2.11/2.2.3/d3c875c9e4bcb4cc43a2a00aa402ca86d30150ed/spark-core_2.11-2.2.3.jar

Dependency Hierarchy:

• spark-mllib_2.11-2.2.3.jar (Root Library)
  • ❌ spark-core_2.11-2.2.3.jar (Vulnerable Library)

Found in HEAD commit: b23ac4a35a28378635d7eef881077d376557bfc5

Found in base branch: master

Vulnerability Details

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its
default of "false", and is not overridden by submitted applications.

Publish Date: 2023-04-17

URL: CVE-2023-22946

CVSS 3 Score Details (9.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://seclists.org/oss-sec/2023/q2/28

Release Date: 2023-04-17

Fix Resolution: org.apache.spark:spark-core:3.4.0