444 lines
21 KiB
HTML
444 lines
21 KiB
HTML
<!DOCTYPE html><html lang="en" theme-color="default" theme-mode=""><head>
|
|
<meta charset="UTF-8">
|
|
<title>Apache Spark instruction injection leak detection - JSKCloud</title>
|
|
<meta name="keywords" content="Documentation">
|
|
<meta name="description" content="Our help documentation provides a wealth of information and resources, including product manuals, technical documents, etc. You can easily find the information you need to help you better understand our products and services. We are constantly updating and improving our documentation to ensure you always have the latest information.">
|
|
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<meta http-equiv="Content-Language" content="en">
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../../assets/92c1df3730f31c-iconfont.css">
|
|
<link rel="stylesheet" href="../../assets/7bd641cba5f6a0-reset.css">
|
|
<link rel="stylesheet" href="../../assets/478794f28834cd-style.css">
|
|
<link rel="stylesheet" href="../../assets/e5adc0b1fcadda-theme.css">
|
|
<link rel="stylesheet" href="../../assets/054352c1c64ab4-common.css">
|
|
<link rel="stylesheet" href="../../assets/51c94e2cd9af75-animate.css">
|
|
<script src="../../assets/dea655e39abf18-jquery-3.5.1.min.js"></script>
|
|
|
|
|
|
<link rel="stylesheet" href="../../assets/43319114264162-bootstrap.min.css">
|
|
<script src="../../assets/b7c64cb3919aba-bootstrap.min.js"></script>
|
|
|
|
<link rel="stylesheet" href="../../assets/c7ac28884e5076-swiper-bundle.min.css">
|
|
<script src="../../assets/130071f2a87d70-swiper-bundle.min.js"></script>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<link rel="stylesheet" href="../../assets/b828918322b016-document.css">
|
|
|
|
<style>
|
|
/* 移动端适配 */
|
|
@media (max-width: 768px) {
|
|
/* 横幅区域优化 */
|
|
.server-banner2.banner-document {
|
|
padding: 30px 0;
|
|
}
|
|
|
|
.server-banner2 .section-content {
|
|
padding: 0 15px;
|
|
}
|
|
|
|
.server-banner2 h1 {
|
|
font-size: 24px;
|
|
margin-bottom: 12px;
|
|
}
|
|
|
|
.server-banner-desc2 {
|
|
font-size: 14px;
|
|
line-height: 1.6;
|
|
margin-bottom: 25px;
|
|
}
|
|
|
|
/* 搜索框适配 */
|
|
.input-search {
|
|
width: 100%;
|
|
flex-direction: column;
|
|
}
|
|
|
|
#document-input {
|
|
width: 100% !important;
|
|
margin-bottom: 10px;
|
|
height: 44px !important;
|
|
}
|
|
|
|
.search-btn {
|
|
width: 100% !important;
|
|
/* height: 44px !important;
|
|
line-height: 44px !important; */
|
|
text-align: center;
|
|
}
|
|
|
|
/* 文档列表适配 */
|
|
.docement-list {
|
|
margin: 0;
|
|
flex-direction: column;
|
|
}
|
|
|
|
.docement-list .document-box {
|
|
width: 100%;
|
|
min-height: auto;
|
|
margin: 10px 0;
|
|
padding: 20px;
|
|
box-sizing: border-box;
|
|
}
|
|
|
|
.document-box .document-header {
|
|
padding-bottom: 15px;
|
|
}
|
|
|
|
.document-box a {
|
|
font-size: 14px;
|
|
line-height: 1.6;
|
|
height: auto;
|
|
}
|
|
|
|
/* 隐藏桌面端导航 */
|
|
.page .nav-left {
|
|
display: none;
|
|
}
|
|
|
|
.page .nav-right,
|
|
.page .content-page {
|
|
padding-left: 0;
|
|
left: 0;
|
|
}
|
|
|
|
/* 内容区域优化 */
|
|
.page .page-content {
|
|
padding: 20px 15px;
|
|
margin-left: 0;
|
|
height: auto;
|
|
}
|
|
|
|
.document-cont {
|
|
padding: 20px 0 !important;
|
|
}
|
|
|
|
/* 文档详情适配 */
|
|
.document-details .document-view-item .document-view-cont {
|
|
padding: 15px;
|
|
}
|
|
|
|
.document-details .document-view-item .document-view-cont a {
|
|
width: 100%;
|
|
padding-right: 0;
|
|
}
|
|
}
|
|
|
|
/* 小屏幕优化 (≤480px) */
|
|
@media (max-width: 480px) {
|
|
.document-box {
|
|
padding: 15px !important;
|
|
}
|
|
|
|
.document-header img {
|
|
width: 24px !important;
|
|
height: 24px !important;
|
|
}
|
|
|
|
.document-details .document-view-head {
|
|
padding-left: 15px !important;
|
|
}
|
|
|
|
.page .page-content .document-head h2 {
|
|
font-size: 20px;
|
|
}
|
|
}
|
|
</style>
|
|
<link rel="canonical" href="7.html"><link rel="alternate" hreflang="zh-Hans" href="../../zh-cn/announce/7.html"><link rel="alternate" hreflang="zh-Hant" href="../../zh-hk/announce/7.html"><link rel="alternate" hreflang="en" href="7.html"><link rel="stylesheet" href="../../assets/site.css"><link rel="stylesheet" href="../../assets/96b2574c658cc1-css2.css"><link rel="stylesheet" href="../../assets/9ea408106ae79c-css2.css"><link rel="stylesheet" href="../../assets/95f8d834964d8a-css2.css"></head>
|
|
|
|
<body data-static-site="jskcloud"><header><style>
|
|
/* 语言选择器样式 */
|
|
.language-selector {
|
|
position: relative;
|
|
margin-right: 20px;
|
|
cursor: pointer;
|
|
z-index: 99999;
|
|
}
|
|
|
|
.language-selected {
|
|
display: flex;
|
|
align-items: center;
|
|
padding: 8px 12px;
|
|
border-radius: 6px;
|
|
background-color: rgba(255, 255, 255, 0.1);
|
|
transition: all 0.3s ease;
|
|
}
|
|
|
|
.language-selected:hover {
|
|
background-color: rgba(255, 255, 255, 0.2);
|
|
}
|
|
|
|
.language-flag {
|
|
margin-right: 8px;
|
|
font-size: 16px;
|
|
}
|
|
|
|
.language-code {
|
|
font-weight: 500;
|
|
margin-right: 8px;
|
|
}
|
|
|
|
.language-arrow {
|
|
transition: transform 0.3s ease;
|
|
}
|
|
|
|
.language-selector.active .language-arrow {
|
|
transform: rotate(180deg);
|
|
}
|
|
|
|
.language-dropdown {
|
|
position: absolute;
|
|
top: 100%;
|
|
/* right: 0; */
|
|
width: 140px;
|
|
background: #fff;
|
|
border-radius: 8px;
|
|
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
|
|
opacity: 0;
|
|
visibility: hidden;
|
|
transform: translateY(10px);
|
|
transition: all 0.3s ease;
|
|
z-index: 1000;
|
|
}
|
|
|
|
.language-selector.active .language-dropdown {
|
|
opacity: 1;
|
|
visibility: visible;
|
|
transform: translateY(0);
|
|
}
|
|
|
|
.language-option {
|
|
display: flex;
|
|
align-items: center;
|
|
padding: 10px 12px;
|
|
color: #333;
|
|
transition: all 0.2s ease;
|
|
}
|
|
|
|
.language-option:hover {
|
|
background-color: #f5f5f5;
|
|
}
|
|
|
|
.language-option .language-flag {
|
|
margin-right: 10px;
|
|
}
|
|
|
|
.language-name {
|
|
font-size: 14px;
|
|
}
|
|
</style>
|
|
<div class="nav-shadow">
|
|
<div class="section-content nav-header">
|
|
<div class="nav-left">
|
|
<div class="nav-icon">
|
|
<a href="../index.html"><img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt=""></a>
|
|
</div>
|
|
<div class="nav-menu">
|
|
<div>
|
|
<a href="../index.html">
|
|
<div class="nav-item">Products</div>
|
|
</a>
|
|
<div class="nav-cont">
|
|
<div class="section-content">
|
|
<div class="nav-cont-menu animated slideInDown">
|
|
<div class="nav-content ">
|
|
<a href="../cloud.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Cloud Server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../dedicated.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Dedicated Server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../balance.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Load Balancer</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../box.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">BOX server</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div>
|
|
<a href="../index.html">
|
|
<div class="nav-item">About Us</div>
|
|
</a>
|
|
<div class="nav-cont">
|
|
<div class="section-content">
|
|
<div class="nav-cont-menu animated slideInDown">
|
|
<div class="nav-content ">
|
|
<a href="../about.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Company Profile</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
<a href="../contact.html">
|
|
<div class="nav-item-box">
|
|
<div class="item-box-title">
|
|
<div class="title">Contact Us</div>
|
|
</div>
|
|
</div>
|
|
</a>
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="mobile-menu-btn" id="mobileMenuBtn"></div>
|
|
</div>
|
|
<div class="nav-right">
|
|
|
|
|
|
<div class="language-selector">
|
|
<div class="language-selected">
|
|
<span class="language-flag">🌐</span>
|
|
<span class="language-code">English</span>
|
|
<svg class="language-arrow" width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">
|
|
<path d="M1 1L5 5L9 1" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
|
|
</svg>
|
|
</div>
|
|
<div class="language-dropdown">
|
|
<a class="language-option" data-lang="en" href="7.html" lang="en" hreflang="en" aria-current="true">English</a>
|
|
<a class="language-option" data-lang="zh-cn" href="../../zh-cn/announce/7.html" lang="zh-cn" hreflang="zh-cn">简体中文</a>
|
|
<a class="language-option" data-lang="zh-hk" href="../../zh-hk/announce/7.html" lang="zh-hk" hreflang="zh-hk">繁體中文</a>
|
|
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div class="aside-tools">
|
|
<div class="tools-list">
|
|
<div class="tools-item">
|
|
<img src="../../assets/82c093ab92edb0-f801662fa2daa58d6b518f4642a32aed1742560323-tg.jpg" alt="">
|
|
<div class="tools-box">
|
|
<div class="tools-box-s">
|
|
<h5>Contact Support</h5>
|
|
<p><a target="_blank" href="https://t.me/JSK215" rel="noopener noreferrer"> Customer Service - Juejue</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSKdang" rel="noopener noreferrer"> Customer Service - Dingdang</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSKyoumi" rel="noopener noreferrer"> Customer Service - Youmi</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSK_666" rel="noopener noreferrer"> Customer Service - Millennium</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSK116" rel="noopener noreferrer"> Customer Service - Panda</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSK0003" rel="noopener noreferrer"> Customer Service - Nao Nao</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSK88801" rel="noopener noreferrer"> Customer Service - Shishi</a></p>
|
|
<p><a target="_blank" href="https://t.me/JSKyaoyao" rel="noopener noreferrer"> Customer Service - Mengyao</a></p> </div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</header><main class="static-main"><article class="static-article"><h1>Apache Spark command injection vulnerability warning</h1><div class="static-date">2023-03-31</div>
|
|
<div data-version="3.0.0" data-hash="3844629fa9b908253e37222c7e195959"> </div>
|
|
<div>
|
|
<div class="document">
|
|
<div class="section">
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Respectful master's command:</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Pleasure! Recently, the Apache Spark official safety announcement was announced, which revealed an Apache Spark specific version of the instruction injection leak (CVE-2022-33891). Apache Spark UI has an ACL mechanism, after opening the ACL, an attacker can use the caveat to fill any arbitrary commands and inject any commands.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Vulnerability Rating]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">High risk</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Vulnerability description]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">CVE-2022-33891</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark is a fast and universal calculation service for large-scale calculations and calculations, and is located at the UC Berkeley AMP lab (AMP lab at the University of California).</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark UI configuration options spark.acls.enable ACLs for use. Please be aware that if you have any questions regarding the course of your order, please see the following. As for ACL, HttpSecurityFilter can be used for any attack by the attacker. This function can be used to import other Unix shell commands, and the final command can be used to import any commands.</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[scope of influence]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark =< 3.0.3</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark 3.1.1 - 3.1.2</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark 3.2.0 - 3.2.1</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Repair Plan]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Currently, the official has released a new version to fix the vulnerability. Affected users are asked to upgrade to a safe version:</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://github.com/apache/spark/tags</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">[Reference link]</span></p>
|
|
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://spark.apache.org/security.html</span></p>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<a class="static-back" href="../announce.html">Back to List</a></article></main><footer class="section footer index">
|
|
|
|
<div class="section-content section-p">
|
|
|
|
|
|
<div class="footer-content">
|
|
<div class="footer-nav">
|
|
<div class="footer-logo">
|
|
<img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt="">
|
|
</div>
|
|
<div class="footer-nav-left">
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">Products</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../cloud.html">Cloud Server</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../dedicated.html">Dedicated Server</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../balance.html">Load Balancer</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../box.html">Box server</a></div>
|
|
</div>
|
|
</div>
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">Support</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../document.html">Documentation</a></div>
|
|
</div>
|
|
</div>
|
|
<div class="footer-nav-box">
|
|
<div class="footer-nav-head">About Us</div>
|
|
<div class="footer-nav-cont">
|
|
<div class="footer-nav-item"><a class="link-hover" href="../about.html">Company Profile</a></div>
|
|
<div class="footer-nav-item"><a class="link-hover" href="../contact.html">Contact Us</a></div>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div class="footer-nav-right">
|
|
<div class="footer-nav-box"><div class="footer-nav-head">Contact Us</div><div class="footer-nav-cont"><div class="footer-nav-item">JSKCloud.net</div><div class="footer-nav-item mt-20"><a class="link-hover" href="https://t.me/JSKCDN999" target="_blank" rel="noopener noreferrer">Telegram @JSKCDN999</a></div></div></div>
|
|
</div>
|
|
</div>
|
|
|
|
|
|
<div class="footer-record">
|
|
<div class="left-info">
|
|
<a href="../index.html" rel="nofollow"> Copyright@2017-2024 JSK cloud TECHNOLOGY PTE. LTD All Rights Reserved</a>
|
|
<a href="../index.html" rel="nofollow"> </a>
|
|
<span> </span>
|
|
</div>
|
|
<span> </span>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
</footer><script src="../../assets/site.js" defer=""></script></body></html> |