spark-proxyuser-classpath

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-proxyuser-classpath spark-proxyuser-classpath Class: Privilege leftover leftover of CVE-2023-22946 / SPARK-41958 Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2023-22946 / SPARK-4195...

Apache Spark Deserialization RCE

The vulnerability of the spark-submit function in the Apache Spark framework is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: GHSA-XG8J-J6VP-6H5W...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.10.0, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.10.0, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.9.0, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.9.0, =0.10.0, =0.10.0, =0.9.0, =0.11.2 Source cves: CVE-2024-51775 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-11444035...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: OSV:GHSA-XG8J-J6VP-6H5W...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.11.1, <=0.11.2), org.apache.zeppelin:zeppelin-spark-submit (>=0.11.1, <=0.11.2) +1 more potentially affected by CVE-2024-51775 via org.apache.zeppelin:zeppelin-shell (>=0.11.1, <=0.11.2)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.11.1, =0.11.1, =0.11.1, =0.11.1, =0.11.2 Source cves: CVE-2024-51775 Source advisory: MEND:CVE-2024-51775...

org.apache.zeppelin:zeppelin-flink-cmd (>=0.10.1, <=0.11.0), org.apache.zeppelin:zeppelin-spark-submit (>=0.10.1, <=0.11.0) +1 more potentially affected by CVE-2024-31861 via org.apache.zeppelin:zeppelin-shell (>=0.10.1, <=0.11.0)

org.apache.zeppelin:zeppelin-shell MAVEN version =0.10.1, =0.10.1, =0.10.1, =0.10.1, =0.11.0 Source cves: CVE-2024-31861 Source advisory: OSV:GHSA-8PFJ-W89W-M24X...

Apache Spark spark-submit RCE

The vulnerability of the spark-submit function in the Apache Spark framework is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Security Bulletin: IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities.

Summary IBM Operations Analytics Predictive Insights v1.3.6 ifix7 contains fixes for multiple security vulnerabilities, listed in the CVEs below. Vulnerability Details CVEID:CVE-2023-32007 DESCRIPTION: Apache Spark could allow a remote authenticated attacker to execute arbitrary commands on the...

Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...

CVE-2023-22946

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...

CVE-2023-22946: Improper Privilege Management

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This...

PT-2023-8745

Name of the Vulnerable Software and Affected Versions Apache Spark versions prior to 3.4.0 Description The issue is related to insecure privilege management in the spark-submit function of Apache Spark. This allows an application to execute code with the privileges of the submitting user by...

Deserialization of untrusted data

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...

CVE-2017-12612

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...