VulnCheck KEV: CVE-2022-33891

Apache Spark contains a command injection vulnerability via Spark User Interface UI when Access Control Lists ACLs are enabled...

ae.teletronics.nlp:entityextraction (=1.3), ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3) +9241 more potentially affected by CVE-2022-45693 via org.codehaus.jettison:jettison (>=1.0 <=1.5.1)

org.codehaus.jettison:jettison MAVEN version =1.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.10 and more Source cves: CVE-2022-45693 Source advisory: OSV:GHSA-GRR4-WV38-F68W...

ae.teletronics.nlp:entityextraction (=1.3), ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3) +9241 more potentially affected by CVE-2022-45685 via org.codehaus.jettison:jettison (>=1.0 <=1.5.1)

org.codehaus.jettison:jettison MAVEN version =1.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.10 and more Source cves: CVE-2022-45685 Source advisory: OSV:GHSA-7RF3-MQPX-H7XG...

Security Bulletin: An Apache-Spark vulnerability affects IBM Operations Analytics Predictive Insights (PVR0342171 )

Summary An Apache-Spark vulnerability affects IBM Operations Analytics Predictive Insights PVR0342171. Apache-Spark is used by IBM Operations Analytics Predictive Insight in the data processing services. The vulnerabilities have been addressed. Vulnerability Details Refer to the security bulletin...

OS Command Injection

apacheairflowprovidersapachespark is vulnerable to os command injection. The vulnerability exists because the custom spark home and custom binaries are not properly handled which allows an attacker to inject and execute arbitrary commands...

GHSA-45R6-J3CC-6MXX OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-40954

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

Command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

PT-2022-25638

Name of the Vulnerable Software and Affected Versions Apache Airflow Spark Provider versions prior to 4.0.0 Apache Airflow versions prior to 2.3.0 Description The issue is related to an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apach...

Apache Airflow 操作系统命令注入漏洞

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow Spark Provider versions prior to 4.0.0...

CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-40954 Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider...

CVE-2022-40954

The CVE-2022-40954 issue is an OS Command Injection in the Apache Airflow Spark Provider that lets an attacker read arbitrary files in the task execution context without file write access to DAGs. Affected products: Spark Provider versions prior to 4.0.0 and Airflow versions prior to 2.3.0 when t...

fr.inria.wimmics:kgimport (=3.3.3), net.sansa-stack:sansa-ml-spark_2.11 (=0.7.1) +61 more potentially affected by CVE-2022-45136 via org.apache.jena:jena-sdb (>=1.4.0 <=3.17.0)

org.apache.jena:jena-sdb MAVEN version =1.4.0, =0.6.0, =0.6.0, =3.1.3, =3.11.0-1, =2.13.0-2, =2.13.0-2, =2.13.0-2, =3.12.0-1, =2.13.0-2, =2.13.0-2, =3.13.1-1 and more Source cves: CVE-2022-45136 Source advisory: OSV:GHSA-G2QW-6VRR-V6PQ...

ai.catboost:catboost-spark_2.11 (>=0.25-rc1 <=0.25-rc3), ai.catboost:catboost-spark_2.12 (>=0.25-rc1 <=0.25-rc3) +4273 more potentially affected by CVE-2022-37865 via org.apache.ivy:ivy (>=2.4.0 <=2.5.0)

org.apache.ivy:ivy MAVEN version =2.4.0, =0.25-rc1, =0.25-rc1, =0.25, =0.25, =0.25, =0.25, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =0.0.25, =0.0.25, =0.0.25, =0.0.25, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91 and more Source cves: CVE-2022-37865 Source advisory: OSV:GHSA-94RR-4JR5-9H2P...

Apache Spark UI Command Injection (CVE-2022-33891)

A command execution vulnerability exists in Apache Spark. The vulnerability is due to errors in parsing user requests when the ACL is enabled...

Apache Spark Injection Vulnerability

Apache Spark, a large-scale data processing engine from the Apache Foundation that supports acyclic data streaming and in-memory computing, is vulnerable to injection. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in a user's web browser...

ai.catboost:catboost-spark_3.3_2.12 (>=1.1 <=1.2.10), ai.h2o:sparkling-water-doc_2.12 (>=3.36.1.3-1-3.3 <=3.38.0.4-1-3.3) +146 more potentially affected by CVE-2022-31777 via org.apache.spark:spark-core_2.12 (=3.3.0)

org.apache.spark:spark-core2.12 MAVEN version =3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.spark:spark-core2.12 and may be impacted: - ai.catboost:catboost-spark3.32.12 =1.1, =3.36.1.3-1-3.3, =0.0.1, =5.2.0, =5.3.1, =5.3.1, =5.3.1,...