CVE-2022-33891: Apache Spark Command Injection Vulnerability
First published: Mon Jul 18 2022(Updated: )
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Spark | <=3.0.3 | |
| Apache Spark | >=3.1.1<=3.1.2 | |
| Apache Spark | >=3.2.0<=3.2.1 | |
| pip/pyspark | >=3.1.1<3.2.2 | 3.2.2 |
| maven/org.apache.spark:spark-parent_2.12 | >=3.1.1<3.2.2 | 3.2.2 |
| maven/org.apache.spark:spark-parent_2.12 | <=3.0.3 | |
| pip/pyspark | >=0<=3.0.3 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-33891
- https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
- https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2022-236.yaml
- http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
- http://www.openwall.com/lists/oss-security/2023/05/02/1
- https://github.com/advisories/GHSA-4x9r-j582-cgr8 (Advisory)
- https://www.bleepingcomputer.com/news/security/hackers-use-poc-exploits-in-attacks-22-minutes-after-release/
- https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc;
- https://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
- https://www.openwall.com/lists/oss-security/2023/05/02/1
Frequently Asked Questions
What is CVE-2022-33891?
CVE-2022-33891 is a vulnerability in Apache Spark that allows command injection.
What is the severity of CVE-2022-33891?
CVE-2022-33891 has a severity rating of 8.8 (High).
How does CVE-2022-33891 affect Apache Spark?
CVE-2022-33891 affects Apache Spark versions 3.0.3 to 3.2.1, as well as pyspark and spark-parent_2.12 packages versions between 3.1.1 and 3.2.2.
How can I fix CVE-2022-33891?
To fix CVE-2022-33891, you should upgrade to Apache Spark version 3.2.2 or higher.
Where can I find more information about CVE-2022-33891?
You can find more information about CVE-2022-33891 at the following references: [1] http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html [2] http://www.openwall.com/lists/oss-security/2023/05/02/1 [3] https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
- collector/github-advisory
- alias/GHSA-4x9r-j582-cgr8
- alias/CVE-2022-33891
- collector/nvd-index
- agent/type
- agent/weakness
- agent/softwarecombine
- agent/title
- agent/author
- agent/severity
- agent/description
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2023-50164
- alias/CVE-2023-29298
- alias/CVE-2023-38203
- alias/CVE-2023-26360
- alias/CVE-2023-35082
- alias/CVE-2024-27198
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- collector/nvd-cve
- source/NVD
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- package-manager/pip
- package-manager/maven
- vendor/apache
- canonical/apache spark
- version/apache spark/3.0.3
- version/apache spark/3.1.1
- version/apache spark/3.1.2
- version/apache spark/3.2.0
- version/apache spark/3.2.1