In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run
    as, limiting privileges. The application can execute code with the privileges of the submitting user,
    however, by providing malicious configuration-related classes on the classpath. This affects architectures
    relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to
    Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is
    set to its default of "false", and is not overridden by submitted applications. (CVE-2023-22946)

The version of Oracle Business Intelligence Enterprise Edition (OAS) 6.4.0.0.0 installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2023 CPU advisory, including the following:

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Analytics Server (Apache Spark)). The supported version that is affected is 6.4.0.0.0. Easily   exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle   Business Intelligence Enterprise Edition. While the vulnerability is in Oracle Business Intelligence   Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks   of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition.
  (CVE-2023-22946)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Analytics Server (Apache Hadoop)). The supported version that is affected is 6.4.0.0.0. Easily   exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle   Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of   Oracle Business Intelligence Enterprise Edition. (CVE-2022-26612)

  - Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics   (component: Content Storage Service (Apache Commons Configuration)). Supported versions that are affected   are 6.4.0.0.0 and 7.0.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network   access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this   vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. (CVE-2022-33980)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of 'false', and is not overridden by submitted applications.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
421691	SCA: security update for org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13, pyspark (GHSA-329j-jfvr-rhr6)	Tenable Cloud Security	SCA Checks	Local	critical
421691	SCA: security update for org.apache.spark:spark-core_2.12, org.apache.spark:spark-core_2.13, pyspark (GHSA-329j-jfvr-rhr6)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
183507	Oracle Business Intelligence Enterprise Edition (OAS 6.4) (October 2023 CPU)	Nessus	Misc.	Local	critical
182512	Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2023-22946

critical

Tenable Plugins

critical

critical

critical

critical