14 matches found
Security Bulletin: IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities.
Summary IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32007 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to execute arbitrary commands on the...
abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +75 more potentially affected by CVE-2023-32007 via pyspark (>=3.1.1, <=3.2.1)
pyspark PYPI version =3.1.1, =0.1.2, =0.1.1, =0.1.5, =0.0.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.2.1, =0.42.2 and more Source cves: CVE-2023-32007 Source advisory: OSV:GHSA-59HW-J9G6-MFG3...
abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +75 more potentially affected by CVE-2023-32007 via pyspark (>=3.1.1, <=3.2.1)
pyspark PYPI version =3.1.1, =0.1.2, =0.1.1, =0.1.5, =0.0.2, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.2.1, =0.42.2 and more Source cves: CVE-2023-32007 Source advisory: GHSA-59HW-J9G6-MFG3...
intake-hive (0.1.0), sparklanes (>=0.2.0, <=0.2.4) potentially affected by CVE-2022-33891 +1 more via pyspark (2.3.0)
pyspark PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - intake-hive 0.1.0 - sparklanes =0.2.0, =0.2.4 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
analytics-zoo (>=0.11.0, <=0.12.0b2022082301), bigdl (>=0.13.0.dev1, <=2.5.0b20240324) +12 more potentially affected by CVE-2022-33891 +1 more via pyspark (2.4.6)
pyspark PYPI version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo =0.11.0, =0.13.0.dev1, =0.14.0b20211027, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =1.0.0, =0.3.0, =0.2.1, =0.4.1 Source cves:...
analytics-zoo (0.4.0) potentially affected by CVE-2022-33891 +1 more via pyspark (2.3.2)
pyspark PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - analytics-zoo 0.4.0 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
owl-sanitizer-data-quality (>=0.1.0, <=0.5.0), pyrasterframes (0.9.0) +2 more potentially affected by CVE-2022-33891 +1 more via pyspark (2.4.5)
pyspark PYPI version 2.4.5 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - owl-sanitizer-data-quality =0.1.0, =0.3.1, =0.3.15 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
nuna-sql-tools (>=0.0.13, <=0.0.17), pydeequ (0.1.5) +1 more potentially affected by CVE-2022-33891 +1 more via pyspark (2.4.7)
pyspark PYPI version 2.4.7 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - nuna-sql-tools =0.0.13, =0.0.17 - pydeequ 0.1.5 - pyrasterframes 0.9.1 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023...
abi-ds-utils (>=0.1.2, <=0.1.9), abi-pyspark-utils (>=0.1.1, <=0.1.4) +101 more potentially affected by CVE-2022-33891 +1 more via pyspark (>=3.0.0, <=3.2.1)
pyspark PYPI version =3.0.0, =0.1.2, =0.1.1, =0.1.5, =0.5.1, =0.0.2, =1.0.0, =0.12.0.dev0, =2.0.0, =2.0.0, =2.0.0, =2.4.0 and more Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
pytispark (2.0.0) potentially affected by CVE-2022-33891 +1 more via pyspark (2.3.3)
pyspark PYPI version 2.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - pytispark 2.0.0 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
elasticpedia (>=1.0.0, <=1.0.1), ml-hadoop-experiment (0.0.1) +2 more potentially affected by CVE-2022-33891 +1 more via pyspark (2.4.4)
pyspark PYPI version 2.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - elasticpedia =1.0.0, =0.1.0, =0.8.4, =0.9.0rc2 Source cves: CVE-2022-33891, CVE-2023-32007 Source advisory: OSV:PYSEC-2023-72...
CVE-2023-32007
CVE-2023-32007 describes a command injection in the Apache Spark UI when ACLs are enabled via spark.acls.enable. A path in HttpSecurityFilter could allow impersonation by supplying an arbitrary username, enabling a permission check to build and execute a Unix shell command as the Spark process us...
CVE-2023-32007 Apache Spark: Shell command injection via Spark UI
UNSUPPORTED WHEN ASSIGNED The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...
