CVE-2023-22946

Advisory

Affected versions of the Apache Spark package are vulnerable to Improper Input Validation due to insufficient restrictions on classpath configurations. The vulnerability exists because applications can specify arbitrary configuration-related classes on the classpath, circumventing the intended privilege limitations imposed by the 'proxy-user' setting. An attacker can exploit this by submitting a malicious application that includes custom classpath entries, allowing execution of code with the privileges of the submitting user rather than the restricted proxy-user, potentially compromising system security.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22946