Apache Spark command injection vulnerability warning

Respectful master's command:

Pleasure! Recently, the Apache Spark official safety announcement was announced, which revealed an Apache Spark specific version of the instruction injection leak (CVE-2022-33891). Apache Spark UI has an ACL mechanism, after opening the ACL, an attacker can use the caveat to fill any arbitrary commands and inject any commands.

[Vulnerability Rating]

High risk

[Vulnerability description]

CVE-2022-33891

Apache Spark is a fast and universal calculation service for large-scale calculations and calculations, and is located at the UC Berkeley AMP lab (AMP lab at the University of California).

Apache Spark UI configuration options spark.acls.enable ACLs for use. Please be aware that if you have any questions regarding the course of your order, please see the following. As for ACL, HttpSecurityFilter can be used for any attack by the attacker. This function can be used to import other Unix shell commands, and the final command can be used to import any commands.

[scope of influence]

Apache Spark =< 3.0.3

Apache Spark 3.1.1 - 3.1.2

Apache Spark 3.2.0 - 3.2.1

[Repair Plan]

Currently, the official has released a new version to fix the vulnerability. Affected users are asked to upgrade to a safe version:

https://github.com/apache/spark/tags

[Reference link]

https://spark.apache.org/security.html