** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected.
NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Java / Kotlin (Maven) | org.apache.spark:spark-parent_2.12 | >= 3.1.1, < 3.2.2 | 3.2.2 |
| Python (PyPI) | pyspark | < 3.2.2 | 3.2.2 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2023-32007
- https://github.com/apache/spark
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-72.yaml
- https://lists.apache.org/thread/poxgnxhhnzz735kr1wos366l5vdbb0nv
- https://spark.apache.org/security.html
- https://www.cve.org/CVERecord?id=CVE-2022-33891
- https://www.openwall.com/lists/oss-security/2023/05/02/1
- http://www.openwall.com/lists/oss-security/2023/05/02/1
- https://github.com/advisories/GHSA-59hw-j9g6-mfg3
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-77- Plataforma
- Java / Kotlin (Maven), Python (PyPI)
- Paquete
org.apache.spark:spark-parent_2.12, pyspark- Publicada
- 02.05.2023
- Actualizado
- 11.10.2026 12:20
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-59hw-j9g6-mfg3 - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2023-72 - PyPA Advisory Database; CC BY 4.0
Historial de vulnerabilidades: pyspark
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 09.2017 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 1
Distribución por gravedad
- Crítica 2
- Alta 5
- Media 5
Divulgaciones por año
- 2017: 1
- 2018: 1
- 2019: 2
- 2020: 1
- 2021: 0
- 2022: 3
- 2023: 2
- 2024: 0
- 2025: 1
- 2026: 1
-
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.