[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 17 Jul 2022 18:40:40 -0500
From: Sean Owen <srowen@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-33891: Apache Spark shell command injection vulnerability
via Spark UI
Severity: important
Description:
The Apache Spark UI offers the possibility to enable ACLs via the
configuration option spark.acls.enable. With an authentication filter, this
checks whether a user has access permissions to view or modify the
application. If ACLs are enabled, a code path in HttpSecurityFilter can
allow someone to perform impersonation by providing an arbitrary user name.
A malicious user might then be able to reach a permission check function
that will ultimately build a Unix shell command based on their input, and
execute it. This will result in arbitrary shell command execution as the
user Spark is currently running as. This affects Apache Spark versions
3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
This issue is being tracked as SPARK-38992
Mitigation:
Upgrade to supported Apache Spark maintenance release 3.1.3, 3.2.2, or
3.3.0 or later
Credit:
Kostya Kortchinsky (Databricks)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
