{"id":"CVE-2023-22946","aliases":["BIT-spark-2023-22946","EUVD-2023-0219","GHSA-329j-jfvr-rhr6","PYSEC-2023-44","ROOT-APP-PYPI-CVE-2023-22946"],"status":"published","title":"Apache Spark proxy-user privilege escalation from malicious configuration class","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01109,"percentile":0.66159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2023-04-17T07:30:19Z","modified":"2026-10-28T02:30:56Z","fixes":[{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","fixed_in":["3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","fixed_in":["3.3.3"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"pyspark","fixed_in":["3.3.2","3.4.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"spark","fixed_in":["3.4.0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.2"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.3.2"},{"fixed":"3.3.3"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"spark","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"versions":["2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.0-preview","3.0.0-preview2","3.0.1","3.0.2","3.0.3","3.1.0","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.spark:spark-core_2.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3"}]}],"versions":["3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2"]},{"source":"osv","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.2"}]}],"versions":["2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"pyspark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0"}]}],"versions":["2.1.1","2.1.2","2.1.3","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","3.0.0","3.0.1","3.0.2","3.0.3","3.1.1","3.1.2","3.1.3","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4"]}],"products":[{"vendor":"apache","product":"spark"},{"vendor":"apache software foundation","product":"apache spark"}],"references":[{"url":"https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-22946","tags":["web","advisory"]},{"url":"https://github.com/apache/spark/pull/39474","tags":["web"]},{"url":"https://github.com/apache/spark/pull/41428","tags":["web"]},{"url":"https://github.com/apache/spark/commit/909da96e1471886a01a9e1def93630c4fd40e74a","tags":["web"]},{"url":"https://github.com/degant/spark/commit/bfba57724d2520e0fcaa7990f7257c21d11cd75a","tags":["web"]},{"url":"https://issues.apache.org/jira/browse/SPARK-41958","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2023-44.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-329j-jfvr-rhr6","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/22xxx/CVE-2023-22946.json","tags":["advisory"]},{"url":"https://github.com/apache/spark","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-22946","title":"Apache Spark proxy-user privilege escalation from malicious configuration class","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.\n\n\n","status":"published","published":"2023-04-17T07:30:19.865Z","modified":"2024-10-21T15:06:58.145Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:15.779187Z"}],"euvd":[{"id":"EUVD-2023-0219","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.\n\n\n","status":"published","published":"2023-04-17T07:30:19Z","modified":"2024-10-21T15:06:58Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:32.038051Z"}],"ghsa":[{"id":"GHSA-329j-jfvr-rhr6","title":"Apache Spark vulnerable to Improper Privilege Management","description":"In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a `proxy-user` to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of \"false\", and is not overridden by submitted applications.","status":"published","published":"2023-04-17T09:30:23Z","modified":"2024-10-15T18:43:47Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:38:10.696798Z"}],"nvd":[{"id":"CVE-2023-22946","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.\n\n\n","status":"published","published":"2023-04-17T08:15:07.79Z","modified":"2026-06-17T05:36:28.993Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:07:55.652109Z"}],"osv":[{"id":"CVE-2023-22946","title":"Apache Spark proxy-user privilege escalation from malicious configuration class","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.\n\n\n","status":"published","published":"2023-04-17T07:30:19.865Z","modified":"2026-10-28T02:30:56.349153471Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"GHSA-329j-jfvr-rhr6","title":"Apache Spark vulnerable to Improper Privilege Management","description":"In Apache Spark versions prior to versions 3.4.0 and 3.3.3, applications using spark-submit can specify a `proxy-user` to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0, 3.3.3, or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of \"false\", and is not overridden by submitted applications.","status":"published","published":"2023-04-17T09:30:23Z","modified":"2024-10-15T18:49:31.436249Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"BIT-spark-2023-22946","title":"Apache Spark proxy-user privilege escalation from malicious configuration class","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n\nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.","status":"published","published":"2024-03-06T11:05:18.484Z","modified":"2026-09-08T08:48:19.475119723Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"PYSEC-2023-44","description":"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.\n \nUpdate to Apache Spark 3.4.0 or later, and ensure that \nspark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its \ndefault of \"false\", and is not overridden by submitted applications.\n\n\n","status":"published","published":"2023-04-17T08:15:00Z","modified":"2026-06-10T17:01:37.151759446Z","updated_at":"2026-11-02T15:52:53.837392Z"},{"id":"ROOT-APP-PYPI-CVE-2023-22946","title":"CVE-2023-22946 in pyspark - Patched by Root","description":"Root has patched CVE-2023-22946 in the pyspark package for Root:PyPI. Multiple fixed versions available.","status":"withdrawn","published":"2026-06-03T20:28:38Z","modified":"2026-09-06T14:00:05.1040971Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}