435 lines
20 KiB
HTML
435 lines
20 KiB
HTML
<!DOCTYPE html><html lang="zh-Hans" theme-color="default" theme-mode=""><head>
|
||
<meta charset="UTF-8">
|
||
<title>Apache Spark 命令注入漏洞预警 - JSKCloud</title>
|
||
<meta name="keywords" content="帮助文档">
|
||
<meta name="description" content="我们的帮助文档提供了丰富的资料和资源，包括产品手册、技术文档等。您可以轻松地找到所需的信息，帮助您更好地了解我们的产品和服务。我们不断更新和完善文档，确保您始终能够获得最新的信息。">
|
||
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||
<meta http-equiv="Content-Language" content="zh-cn">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/92c1df3730f31c-iconfont.css">
|
||
<link rel="stylesheet" href="../../assets/7bd641cba5f6a0-reset.css">
|
||
<link rel="stylesheet" href="../../assets/478794f28834cd-style.css">
|
||
<link rel="stylesheet" href="../../assets/e5adc0b1fcadda-theme.css">
|
||
<link rel="stylesheet" href="../../assets/054352c1c64ab4-common.css">
|
||
<link rel="stylesheet" href="../../assets/51c94e2cd9af75-animate.css">
|
||
<script src="../../assets/dea655e39abf18-jquery-3.5.1.min.js"></script>
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/43319114264162-bootstrap.min.css">
|
||
<script src="../../assets/b7c64cb3919aba-bootstrap.min.js"></script>
|
||
|
||
<link rel="stylesheet" href="../../assets/c7ac28884e5076-swiper-bundle.min.css">
|
||
<script src="../../assets/130071f2a87d70-swiper-bundle.min.js"></script>
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../../assets/b828918322b016-document.css">
|
||
|
||
<style>
|
||
/* 移动端适配 */
|
||
@media (max-width: 768px) {
|
||
/* 横幅区域优化 */
|
||
.server-banner2.banner-document {
|
||
padding: 30px 0;
|
||
}
|
||
|
||
.server-banner2 .section-content {
|
||
padding: 0 15px;
|
||
}
|
||
|
||
.server-banner2 h1 {
|
||
font-size: 24px;
|
||
margin-bottom: 12px;
|
||
}
|
||
|
||
.server-banner-desc2 {
|
||
font-size: 14px;
|
||
line-height: 1.6;
|
||
margin-bottom: 25px;
|
||
}
|
||
|
||
/* 搜索框适配 */
|
||
.input-search {
|
||
width: 100%;
|
||
flex-direction: column;
|
||
}
|
||
|
||
#document-input {
|
||
width: 100% !important;
|
||
margin-bottom: 10px;
|
||
height: 44px !important;
|
||
}
|
||
|
||
.search-btn {
|
||
width: 100% !important;
|
||
/* height: 44px !important;
|
||
line-height: 44px !important; */
|
||
text-align: center;
|
||
}
|
||
|
||
/* 文档列表适配 */
|
||
.docement-list {
|
||
margin: 0;
|
||
flex-direction: column;
|
||
}
|
||
|
||
.docement-list .document-box {
|
||
width: 100%;
|
||
min-height: auto;
|
||
margin: 10px 0;
|
||
padding: 20px;
|
||
box-sizing: border-box;
|
||
}
|
||
|
||
.document-box .document-header {
|
||
padding-bottom: 15px;
|
||
}
|
||
|
||
.document-box a {
|
||
font-size: 14px;
|
||
line-height: 1.6;
|
||
height: auto;
|
||
}
|
||
|
||
/* 隐藏桌面端导航 */
|
||
.page .nav-left {
|
||
display: none;
|
||
}
|
||
|
||
.page .nav-right,
|
||
.page .content-page {
|
||
padding-left: 0;
|
||
left: 0;
|
||
}
|
||
|
||
/* 内容区域优化 */
|
||
.page .page-content {
|
||
padding: 20px 15px;
|
||
margin-left: 0;
|
||
height: auto;
|
||
}
|
||
|
||
.document-cont {
|
||
padding: 20px 0 !important;
|
||
}
|
||
|
||
/* 文档详情适配 */
|
||
.document-details .document-view-item .document-view-cont {
|
||
padding: 15px;
|
||
}
|
||
|
||
.document-details .document-view-item .document-view-cont a {
|
||
width: 100%;
|
||
padding-right: 0;
|
||
}
|
||
}
|
||
|
||
/* 小屏幕优化 (≤480px) */
|
||
@media (max-width: 480px) {
|
||
.document-box {
|
||
padding: 15px !important;
|
||
}
|
||
|
||
.document-header img {
|
||
width: 24px !important;
|
||
height: 24px !important;
|
||
}
|
||
|
||
.document-details .document-view-head {
|
||
padding-left: 15px !important;
|
||
}
|
||
|
||
.page .page-content .document-head h2 {
|
||
font-size: 20px;
|
||
}
|
||
}
|
||
</style>
|
||
<link rel="canonical" href="7.html"><link rel="alternate" hreflang="zh-Hans" href="7.html"><link rel="alternate" hreflang="zh-Hant" href="../../zh-hk/announce/7.html"><link rel="alternate" hreflang="en" href="../../en/announce/7.html"><link rel="stylesheet" href="../../assets/site.css"><link rel="stylesheet" href="../../assets/b0317f003749a5-css2.css"><link rel="stylesheet" href="../../assets/de0a696a420db8-css2.css"><link rel="stylesheet" href="../../assets/13192273b45a60-css2.css"></head>
|
||
|
||
<body data-static-site="jskcloud"><header><style>
|
||
/* 语言选择器样式 */
|
||
.language-selector {
|
||
position: relative;
|
||
margin-right: 20px;
|
||
cursor: pointer;
|
||
z-index: 99999;
|
||
}
|
||
|
||
.language-selected {
|
||
display: flex;
|
||
align-items: center;
|
||
padding: 8px 12px;
|
||
border-radius: 6px;
|
||
background-color: rgba(255, 255, 255, 0.1);
|
||
transition: all 0.3s ease;
|
||
}
|
||
|
||
.language-selected:hover {
|
||
background-color: rgba(255, 255, 255, 0.2);
|
||
}
|
||
|
||
.language-flag {
|
||
margin-right: 8px;
|
||
font-size: 16px;
|
||
}
|
||
|
||
.language-code {
|
||
font-weight: 500;
|
||
margin-right: 8px;
|
||
}
|
||
|
||
.language-arrow {
|
||
transition: transform 0.3s ease;
|
||
}
|
||
|
||
.language-selector.active .language-arrow {
|
||
transform: rotate(180deg);
|
||
}
|
||
|
||
.language-dropdown {
|
||
position: absolute;
|
||
top: 100%;
|
||
/* right: 0; */
|
||
width: 140px;
|
||
background: #fff;
|
||
border-radius: 8px;
|
||
box-shadow: 0 4px 12px rgba(0, 0, 0, 0.15);
|
||
opacity: 0;
|
||
visibility: hidden;
|
||
transform: translateY(10px);
|
||
transition: all 0.3s ease;
|
||
z-index: 1000;
|
||
}
|
||
|
||
.language-selector.active .language-dropdown {
|
||
opacity: 1;
|
||
visibility: visible;
|
||
transform: translateY(0);
|
||
}
|
||
|
||
.language-option {
|
||
display: flex;
|
||
align-items: center;
|
||
padding: 10px 12px;
|
||
color: #333;
|
||
transition: all 0.2s ease;
|
||
}
|
||
|
||
.language-option:hover {
|
||
background-color: #f5f5f5;
|
||
}
|
||
|
||
.language-option .language-flag {
|
||
margin-right: 10px;
|
||
}
|
||
|
||
.language-name {
|
||
font-size: 14px;
|
||
}
|
||
</style>
|
||
<div class="nav-shadow">
|
||
<div class="section-content nav-header">
|
||
<div class="nav-left">
|
||
<div class="nav-icon">
|
||
<a href="../index.html"><img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt=""></a>
|
||
</div>
|
||
<div class="nav-menu">
|
||
<div>
|
||
<a href="../index.html">
|
||
<div class="nav-item">产品中心</div>
|
||
</a>
|
||
<div class="nav-cont">
|
||
<div class="section-content">
|
||
<div class="nav-cont-menu animated slideInDown">
|
||
<div class="nav-content ">
|
||
<a href="../cloud.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">云服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../dedicated.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">独立服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../balance.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">负载均衡</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../box.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">BOX服务器</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div>
|
||
<a href="../index.html">
|
||
<div class="nav-item">关于我们</div>
|
||
</a>
|
||
<div class="nav-cont">
|
||
<div class="section-content">
|
||
<div class="nav-cont-menu animated slideInDown">
|
||
<div class="nav-content ">
|
||
<a href="../about.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">公司简介</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
<a href="../contact.html">
|
||
<div class="nav-item-box">
|
||
<div class="item-box-title">
|
||
<div class="title">联系我们</div>
|
||
</div>
|
||
</div>
|
||
</a>
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
<div class="mobile-menu-btn" id="mobileMenuBtn"></div>
|
||
</div>
|
||
<div class="nav-right">
|
||
|
||
|
||
<div class="language-selector">
|
||
<div class="language-selected">
|
||
<span class="language-flag">🌐</span>
|
||
<span class="language-code">简体中文</span>
|
||
<svg class="language-arrow" width="10" height="6" viewBox="0 0 10 6" fill="none" xmlns="http://www.w3.org/2000/svg">
|
||
<path d="M1 1L5 5L9 1" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"></path>
|
||
</svg>
|
||
</div>
|
||
<div class="language-dropdown">
|
||
<a class="language-option" data-lang="en" href="../../en/announce/7.html" lang="en" hreflang="en">English</a>
|
||
<a class="language-option" data-lang="zh-cn" href="7.html" lang="zh-cn" hreflang="zh-cn" aria-current="true">简体中文</a>
|
||
<a class="language-option" data-lang="zh-hk" href="../../zh-hk/announce/7.html" lang="zh-hk" hreflang="zh-hk">繁體中文</a>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
<div class="aside-tools">
|
||
<div class="tools-list">
|
||
<div class="tools-item">
|
||
<a class="static-contact-trigger" href="https://t.me/JSKCDN999" target="_blank" aria-label="通过 Telegram 联系 JSKCloud" rel="noopener noreferrer"><img src="../../assets/82c093ab92edb0-f801662fa2daa58d6b518f4642a32aed1742560323-tg.jpg" alt=""></a>
|
||
<div class="tools-box">
|
||
<div class="tools-box-s"><h5>联系客服</h5><p><a target="_blank" href="https://t.me/JSKCDN999" rel="noopener noreferrer">@JSKCDN999</a></p></div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</header><main class="static-main"><article class="static-article"><h1>Apache Spark 命令注入漏洞预警</h1><div class="static-date">2023-03-31</div>
|
||
<div data-version="3.0.0" data-hash="3844629fa9b908253e37222c7e195959"> </div>
|
||
<div>
|
||
<div class="document">
|
||
<div class="section">
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">尊敬的主题云用户：</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">您好！ 近日，Apache Spark官方发布安全公告，披露在Apache Spark特定版本中存在一处命令注入漏洞（CVE-2022-33891）。Apache Spark UI具有ACL机制，当开启ACL后，攻击者可利用漏洞冒充任意用户进行任意命令注入并执行。</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【漏洞评级】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">高风险</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【漏洞描述】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">CVE-2022-33891</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark 是专为大规模数据处理而设计的快速通用的计算引擎，是UC Berkeley AMP lab （加州大学伯克利分校的AMP实验室）所开源的类Hadoop MapReduce的通用并行框架。</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark UI 中可通过配置选项 spark.acls.enable 启用 ACL 。这些身份验证过滤器会检查用户是否具有查看或修改应用程序的访问权限。如果启用ACL，则 HttpSecurityFilter 中的代码路径可允许攻击者冒充任意用户。该功能可根据他们的输入创建一个 Unix shell 命令并执行，最终导致执行任意命令。</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【影响范围】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark =< 3.0.3</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark 3.1.1 - 3.1.2</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">Apache Spark 3.2.0 - 3.2.1</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【修复方案】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">目前，官方已发布新版本修复了该漏洞，请受影响的用户升级到安全版本：</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://github.com/apache/spark/tags</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">【参考链接】</span></p>
|
||
<p class="paragraph text-align-type-justify" style="margin: 0pt 0pt 7.8pt; text-align: justify; font-family: 等线; font-size: 12pt; line-height: 24px;"><span style="font-size: 10.5pt; font-family: 宋体; letter-spacing: 0pt; vertical-align: baseline;" data-font-family="宋体">https://spark.apache.org/security.html</span></p>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
<a class="static-back" href="../announce.html">返回列表</a></article></main><footer class="section footer index">
|
||
|
||
<div class="section-content section-p">
|
||
|
||
|
||
<div class="footer-content">
|
||
<div class="footer-nav">
|
||
<div class="footer-logo">
|
||
<img src="../../assets/f47e84e194e9c4-c47cdbdba8c01d82740fc430f77aaa6f1792437534-222.png" alt="">
|
||
</div>
|
||
<div class="footer-nav-left">
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">产品中心</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../cloud.html">云服务器</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../dedicated.html">独立服务器</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../balance.html">负载均衡</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../box.html">Box服务器</a></div>
|
||
</div>
|
||
</div>
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">技术支持</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../document.html">技术文档</a></div>
|
||
</div>
|
||
</div>
|
||
<div class="footer-nav-box">
|
||
<div class="footer-nav-head">关于我们</div>
|
||
<div class="footer-nav-cont">
|
||
<div class="footer-nav-item"><a class="link-hover" href="../about.html">公司简介</a></div>
|
||
<div class="footer-nav-item"><a class="link-hover" href="../contact.html">联系我们</a></div>
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div class="footer-nav-right">
|
||
<div class="footer-nav-box"><div class="footer-nav-head">联系我们</div><div class="footer-nav-cont"><div class="footer-nav-item">JSKCloud.net</div><div class="footer-nav-item mt-20"><a class="link-hover" href="https://t.me/JSKCDN999" target="_blank" rel="noopener noreferrer">Telegram @JSKCDN999</a></div></div></div>
|
||
</div>
|
||
</div>
|
||
|
||
|
||
<div class="footer-record">
|
||
<div class="left-info">
|
||
<a href="../index.html" rel="nofollow"> Copyright@2017-2024 JSK cloud TECHNOLOGY PTE. LTD 版权所有 All Rights Reserved</a>
|
||
<a href="../index.html" rel="nofollow"> </a>
|
||
<span> </span>
|
||
</div>
|
||
<span> </span>
|
||
</div>
|
||
</div>
|
||
</div>
|
||
|
||
</footer><script src="../../assets/site.js" defer=""></script></body></html> |