CVSS 3.1
9.9 criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HCVE-2023-22946
Critical (9.9) in apache spark. EPSS 1.1% chance of exploitation in the next 30 days. Fixed in org.apache.spark:spark-core_2.12 3.3.3.
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.
Update to Apache Spark 3.4.0 or later, and ensure that
spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its
default of "false", and is not overridden by submitted applications.
Severity
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 65% of CVEs (scores of 2026-10-31)
- CWE
- CWE-269
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:spark
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-329j-jfvr-rhr6 | Maven | org.apache.spark:spark-core_2.12 | <3.3.3 | 3.3.3 |
| GHSA-329j-jfvr-rhr6 | Maven | org.apache.spark:spark-core_2.13 | <3.3.3 | 3.3.3 |
| GHSA-329j-jfvr-rhr6 | PyPI | pyspark | <3.3.2 | 3.3.2 |
| PYSEC-2023-44 | PyPI | pyspark | <3.4.0 | 3.4.0 |