Star0
5
Code
Code
Issues22
Pull Requests4
Discussion
Wiki
Analysis
Star0
5
Closed
Fix CVE-2022-31777, CVE-2023-22946, CVE-2023-32007, CVE-2025-55039 #86
chenyanpanAdd on Aug 24Closed at Sep 28
Fix CVE-2022-31777, CVE-2023-22946, CVE-2023-32007, CVE-2025-55039 #86
Closed
chenyanpanAdd on Aug 24Closed at Sep 28
Merged fromchenyanpan/sparkfix-cves-20260824-191023intosrc-openeuler/sparkopenEuler-24.03-LTS-Next
Total: 8 files changed+7818-1
Abackport-CVE-2022-31777-2.patch+537-0
@@ -0,0 +1,537 @@
1+From 78a5825fe266c0884d2dd18cbca9625fa258d7f7 Mon Sep 17 00:00:00 2001
2+From: Dongjoon Hyun <dongjoon@apache.org>
3+Date: Mon, 11 Jul 2022 15:13:02 +0000
4+Subject: [PATCH] Preparing Spark release v3.2.2-rc1
5+ 
6+---
7+ assembly/pom.xml | 2 +-
8+ common/kvstore/pom.xml | 2 +-
9+ common/network-common/pom.xml | 2 +-
10+ common/network-shuffle/pom.xml | 2 +-
11+ common/network-yarn/pom.xml | 2 +-
12+ common/sketch/pom.xml | 2 +-
13+ common/tags/pom.xml | 2 +-
14+ common/unsafe/pom.xml | 2 +-
15+ core/pom.xml | 2 +-
16+ docs/_config.yml | 2 +-
17+ examples/pom.xml | 2 +-
18+ external/avro/pom.xml | 2 +-
19+ external/docker-integration-tests/pom.xml | 2 +-
20+ external/kafka-0-10-assembly/pom.xml | 2 +-
21+ external/kafka-0-10-sql/pom.xml | 2 +-
22+ external/kafka-0-10-token-provider/pom.xml | 2 +-
23+ external/kafka-0-10/pom.xml | 2 +-
24+ external/kinesis-asl-assembly/pom.xml | 2 +-
25+ external/kinesis-asl/pom.xml | 2 +-
26+ external/spark-ganglia-lgpl/pom.xml | 2 +-
27+ graphx/pom.xml | 2 +-
28+ hadoop-cloud/pom.xml | 2 +-
29+ launcher/pom.xml | 2 +-
30+ mllib-local/pom.xml | 2 +-
31+ mllib/pom.xml | 2 +-
32+ pom.xml | 2 +-
33+ python/pyspark/version.py | 2 +-
34+ repl/pom.xml | 2 +-
35+ resource-managers/kubernetes/core/pom.xml | 2 +-
36+ resource-managers/kubernetes/integration-tests/pom.xml | 2 +-
37+ resource-managers/mesos/pom.xml | 2 +-
38+ resource-managers/yarn/pom.xml | 2 +-
39+ sql/catalyst/pom.xml | 2 +-
40+ sql/core/pom.xml | 2 +-
41+ sql/hive-thriftserver/pom.xml | 2 +-
42+ sql/hive/pom.xml | 2 +-
43+ streaming/pom.xml | 2 +-
44+ tools/pom.xml | 2 +-
45+ 38 files changed, 38 insertions(+), 38 deletions(-)
46+ 
47+diff --git a/assembly/pom.xml b/assembly/pom.xml
48+index 9584884b003f2..7248e549a9cde 100644
49+--- a/assembly/pom.xml
50++++ b/assembly/pom.xml
51+@@ -21,7 +21,7 @@
52+ <parent>
53+ <groupId>org.apache.spark</groupId>
54+ <artifactId>spark-parent_2.12</artifactId>
55+- <version>3.2.2-SNAPSHOT</version>
56++ <version>3.2.2</version>
57+ <relativePath>../pom.xml</relativePath>
58+ </parent>
59+
60+diff --git a/common/kvstore/pom.xml b/common/kvstore/pom.xml
61+index 167e69f9e6eda..42f54b5f1109d 100644
62+--- a/common/kvstore/pom.xml
63++++ b/common/kvstore/pom.xml
64+@@ -22,7 +22,7 @@
65+ <parent>
66+ <groupId>org.apache.spark</groupId>
67+ <artifactId>spark-parent_2.12</artifactId>
68+- <version>3.2.2-SNAPSHOT</version>
69++ <version>3.2.2</version>
70+ <relativePath>../../pom.xml</relativePath>
71+ </parent>
72+
73+diff --git a/common/network-common/pom.xml b/common/network-common/pom.xml
74+index eaf1c1e12e221..d74828a18b00d 100644
75+--- a/common/network-common/pom.xml
76++++ b/common/network-common/pom.xml
77+@@ -22,7 +22,7 @@
78+ <parent>
79+ <groupId>org.apache.spark</groupId>
80+ <artifactId>spark-parent_2.12</artifactId>
81+- <version>3.2.2-SNAPSHOT</version>
82++ <version>3.2.2</version>
83+ <relativePath>../../pom.xml</relativePath>
84+ </parent>
85+
86+diff --git a/common/network-shuffle/pom.xml b/common/network-shuffle/pom.xml
87+index 811e5035c4658..7e73e2e1bc440 100644
88+--- a/common/network-shuffle/pom.xml
89++++ b/common/network-shuffle/pom.xml
90+@@ -22,7 +22,7 @@
91+ <parent>
92+ <groupId>org.apache.spark</groupId>
93+ <artifactId>spark-parent_2.12</artifactId>
94+- <version>3.2.2-SNAPSHOT</version>
95++ <version>3.2.2</version>
96+ <relativePath>../../pom.xml</relativePath>
97+ </parent>
98+
99+diff --git a/common/network-yarn/pom.xml b/common/network-yarn/pom.xml
100+index 23513f6043940..f7e6a344d7d36 100644
Abackport-CVE-2022-31777.patch+51-0
@@ -0,0 +1,51 @@
1+From 37dbf1cc99ab888342d04b0bf41619ff597ddab9 Mon Sep 17 00:00:00 2001
2+From: Sean Owen <srowen@gmail.com>
3+Date: Fri, 17 Jun 2022 09:36:49 -0700
4+Subject: [PATCH] [SPARK-39505][UI] Escape log content rendered in UI
5+ 
6+### What changes were proposed in this pull request?
7+ 
8+Escape log content rendered to the UI.
9+ 
10+### Why are the changes needed?
11+ 
12+Log content may contain reserved characters or other code in the log and be misinterpreted in the UI as HTML.
13+ 
14+### Does this PR introduce _any_ user-facing change?
15+ 
16+No
17+ 
18+### How was this patch tested?
19+ 
20+Existing tests
21+ 
22+Closes #36902 from srowen/LogViewEscape.
23+ 
24+Authored-by: Sean Owen <srowen@gmail.com>
25+Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>
26+---
27+ .../src/main/resources/org/apache/spark/ui/static/log-view.js | 4 ++--
28+ 1 file changed, 2 insertions(+), 2 deletions(-)
29+ 
30+diff --git a/core/src/main/resources/org/apache/spark/ui/static/log-view.js b/core/src/main/resources/org/apache/spark/ui/static/log-view.js
31+index 2f416d8210e18..92df087f4bd92 100644
32+--- a/core/src/main/resources/org/apache/spark/ui/static/log-view.js
33++++ b/core/src/main/resources/org/apache/spark/ui/static/log-view.js
34+@@ -85,7 +85,7 @@ function loadMore() {
35+ if (retStartByte == 0) {
36+ disableMoreButton();
37+ }
38+- $("pre", ".log-content").prepend(cleanData);
39++ $("pre", ".log-content").prepend(document.createTextNode(cleanData));
40+
41+ curLogLength = curLogLength + (startByte - retStartByte);
42+ startByte = retStartByte;
43+@@ -115,7 +115,7 @@ function loadNew() {
44+ var retLogLength = dataInfo[2];
45+
46+ var cleanData = data.substring(newlineIndex + 1);
47+- $("pre", ".log-content").append(cleanData);
48++ $("pre", ".log-content").append(document.createTextNode(cleanData));
49+
50+ curLogLength = curLogLength + (retEndByte - retStartByte);
51+ endByte = retEndByte;
Abackport-CVE-2023-22946.patch+88-0
@@ -0,0 +1,88 @@
1+From 909da96e1471886a01a9e1def93630c4fd40e74a Mon Sep 17 00:00:00 2001
2+From: Peter Toth <peter.toth@gmail.com>
3+Date: Tue, 10 Jan 2023 18:05:52 +0900
4+Subject: [PATCH] [SPARK-41958][CORE] Disallow arbitrary custom classpath with
5+ proxy user in cluster mode
6+ 
7+### What changes were proposed in this pull request?
8+ 
9+This PR proposes to disallow arbitrary custom classpath with proxy user in cluster mode by default.
10+ 
11+### Why are the changes needed?
12+ 
13+To avoid arbitrary classpath in spark cluster.
14+ 
15+### Does this PR introduce _any_ user-facing change?
16+ 
17+Yes. User should reenable this feature by `spark.submit.proxyUser.allowCustomClasspathInClusterMode`.
18+ 
19+### How was this patch tested?
20+ 
21+Manually tested.
22+ 
23+Closes #39474 from Ngone51/dev.
24+ 
25+Lead-authored-by: Peter Toth <peter.toth@gmail.com>
26+Co-authored-by: Yi Wu <yi.wu@databricks.com>
27+Signed-off-by: Hyukjin Kwon <gurwls223@apache.org>
28+---
29+ .../org/apache/spark/deploy/SparkSubmit.scala | 15 +++++++++++++++
30+ .../apache/spark/internal/config/package.scala | 7 +++++++
31+ 2 files changed, 22 insertions(+)
32+ 
33+diff --git a/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala b/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala
34+index 65e4367b33afe..a701b0ea60702 100644
35+--- a/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala
36++++ b/core/src/main/scala/org/apache/spark/deploy/SparkSubmit.scala
37+@@ -306,6 +306,10 @@ private[spark] class SparkSubmit extends Logging {
38+ val isKubernetesClient = clusterManager == KUBERNETES && deployMode == CLIENT
39+ val isKubernetesClusterModeDriver = isKubernetesClient &&
40+ sparkConf.getBoolean("spark.kubernetes.submitInDriver", false)
41++ val isCustomClasspathInClusterModeDisallowed =
42++ !sparkConf.get(ALLOW_CUSTOM_CLASSPATH_BY_PROXY_USER_IN_CLUSTER_MODE) &&
43++ args.proxyUser != null &&
44++ (isYarnCluster || isMesosCluster || isStandAloneCluster || isKubernetesCluster)
45+
46+ if (!isMesosCluster && !isStandAloneCluster) {
47+ // Resolve maven dependencies if there are any and add classpath to jars. Add them to py-files
48+@@ -887,6 +891,13 @@ private[spark] class SparkSubmit extends Logging {
49+
50+ sparkConf.set("spark.app.submitTime", System.currentTimeMillis().toString)
51+
52++ if (childClasspath.nonEmpty && isCustomClasspathInClusterModeDisallowed) {
53++ childClasspath.clear()
54++ logWarning(s"Ignore classpath ${childClasspath.mkString(", ")} with proxy user specified " +
55++ s"in Cluster mode when ${ALLOW_CUSTOM_CLASSPATH_BY_PROXY_USER_IN_CLUSTER_MODE.key} is " +
56++ s"disabled")
57++ }
58++
59+ (childArgs.toSeq, childClasspath.toSeq, sparkConf, childMainClass)
60+ }
61+
62+@@ -940,6 +951,10 @@ private[spark] class SparkSubmit extends Logging {
63+ logInfo(s"Classpath elements:\n${childClasspath.mkString("\n")}")
64+ logInfo("\n")
65+ }
66++ assert(!(args.deployMode == "cluster" && args.proxyUser != null && childClasspath.nonEmpty) ||
67++ sparkConf.get(ALLOW_CUSTOM_CLASSPATH_BY_PROXY_USER_IN_CLUSTER_MODE),
68++ s"Classpath of spark-submit should not change in cluster mode if proxy user is specified " +
69++ s"when ${ALLOW_CUSTOM_CLASSPATH_BY_PROXY_USER_IN_CLUSTER_MODE.key} is disabled")
70+ val loader = getSubmitClassLoader(sparkConf)
71+ for (jar <- childClasspath) {
72+ addJarToClasspath(jar, loader)
73+diff --git a/core/src/main/scala/org/apache/spark/internal/config/package.scala b/core/src/main/scala/org/apache/spark/internal/config/package.scala
74+index eb6ac8b765b01..be210cfe59b3d 100644
75+--- a/core/src/main/scala/org/apache/spark/internal/config/package.scala
76++++ b/core/src/main/scala/org/apache/spark/internal/config/package.scala
77+@@ -2461,4 +2461,11 @@ package object config {
78+ .version("3.4.0")
79+ .timeConf(TimeUnit.MILLISECONDS)
80+ .createWithDefaultString("5s")
81++
82++ private[spark] val ALLOW_CUSTOM_CLASSPATH_BY_PROXY_USER_IN_CLUSTER_MODE =
83++ ConfigBuilder("spark.submit.proxyUser.allowCustomClasspathInClusterMode")
84++ .internal()
85++ .version("3.4.0")
86++ .booleanConf
87++ .createWithDefault(false)
88+ }
Abackport-CVE-2023-32007.patch+55-0
@@ -0,0 +1,55 @@
1+From 1d524a88f6e93e9971a09f70eb2804dca51d578c Mon Sep 17 00:00:00 2001
2+From: Hyukjin Kwon <gurwls223@apache.org>
3+Date: Fri, 22 Apr 2022 19:01:05 +0900
4+Subject: [PATCH] [SPARK-38992][CORE] Avoid using bash -c in
5+ ShellBasedGroupsMappingProvider
6+ 
7+### What changes were proposed in this pull request?
8+ 
9+This PR proposes to avoid using `bash -c` in `ShellBasedGroupsMappingProvider`. This could allow users a command injection.
10+ 
11+### Why are the changes needed?
12+ 
13+For a security purpose.
14+ 
15+### Does this PR introduce _any_ user-facing change?
16+ 
17+Virtually no.
18+ 
19+### How was this patch tested?
20+ 
21+Manually tested.
22+ 
23+Closes #36315 from HyukjinKwon/SPARK-38992.
24+ 
25+Authored-by: Hyukjin Kwon <gurwls223@apache.org>
26+Signed-off-by: Hyukjin Kwon <gurwls223@apache.org>
27+(cherry picked from commit c83618e4e5fc092829a1f2a726f12fb832e802cc)
28+Signed-off-by: Hyukjin Kwon <gurwls223@apache.org>
29+---
30+ .../spark/security/ShellBasedGroupsMappingProvider.scala | 5 +++--
31+ 1 file changed, 3 insertions(+), 2 deletions(-)
32+ 
33+diff --git a/core/src/main/scala/org/apache/spark/security/ShellBasedGroupsMappingProvider.scala b/core/src/main/scala/org/apache/spark/security/ShellBasedGroupsMappingProvider.scala
34+index f71dd08246b2f..7ef8ef165e3a2 100644
35+--- a/core/src/main/scala/org/apache/spark/security/ShellBasedGroupsMappingProvider.scala
36++++ b/core/src/main/scala/org/apache/spark/security/ShellBasedGroupsMappingProvider.scala
37+@@ -30,6 +30,8 @@ import org.apache.spark.util.Utils
38+ private[spark] class ShellBasedGroupsMappingProvider extends GroupMappingServiceProvider
39+ with Logging {
40+
41++ private lazy val idPath = Utils.executeAndGetOutput("which" :: "id" :: Nil).stripLineEnd
42++
43+ override def getGroups(username: String): Set[String] = {
44+ val userGroups = getUnixGroups(username)
45+ logDebug("User: " + username + " Groups: " + userGroups.mkString(","))
46+@@ -38,8 +40,7 @@ private[spark] class ShellBasedGroupsMappingProvider extends GroupMappingService
47+
48+ // shells out a "bash -c id -Gn username" to get user groups
49+ private def getUnixGroups(username: String): Set[String] = {
50+- val cmdSeq = Seq("bash", "-c", "id -Gn " + username)
51+ // we need to get rid of the trailing "\n" from the result of command execution
52+- Utils.executeAndGetOutput(cmdSeq).stripLineEnd.split(" ").toSet
53++ Utils.executeAndGetOutput(idPath :: "-Gn" :: username :: Nil).stripLineEnd.split(" ").toSet
54+ }
55+ }
Abackport-CVE-2025-55039-2.patch+2343-0
Abackport-CVE-2025-55039-3.patch+2363-0
Abackport-CVE-2025-55039.patch+2363-0
Mspark.spec+18-1
@@ -4,7 +4,7 @@
4Summary: A unified analytics engine for large-scale data processing.4Summary: A unified analytics engine for large-scale data processing.
5Name: spark5Name: spark
6Version: 3.5.06Version: 3.5.0
7-Release: 67+Release: 7
8License: Apache 2.08License: Apache 2.0
9URL: http://spark.apache.org/9URL: http://spark.apache.org/
10Source0: https://github.com/apache/spark/archive/v%{version}.tar.gz10Source0: https://github.com/apache/spark/archive/v%{version}.tar.gz
@@ -24,6 +24,13 @@ Patch1002: 1002-Added-support-for-building-the-riscv64-protoc-gen-gr.patch
24Patch1003: 1003-Added-support-for-building-the-loongarch64-protoc-bi.patch24Patch1003: 1003-Added-support-for-building-the-loongarch64-protoc-bi.patch
25Patch1004: 1004-Add-protoc-java-support-for-loongarch64.patch25Patch1004: 1004-Add-protoc-java-support-for-loongarch64.patch
26Patch1005: 1005-Added-support-for-building-the-loongarch64-protoc-ge.patch26Patch1005: 1005-Added-support-for-building-the-loongarch64-protoc-ge.patch
27+Patch1006: backport-CVE-2022-31777.patch
28+Patch1007: backport-CVE-2022-31777-2.patch
29+Patch1008: backport-CVE-2023-22946.patch
30+Patch1009: backport-CVE-2023-32007.patch
31+Patch1010: backport-CVE-2025-55039.patch
32+Patch1011: backport-CVE-2025-55039-2.patch
33+Patch1012: backport-CVE-2025-55039-3.patch
27 34 
28%ifarch riscv64 loongarch6435%ifarch riscv64 loongarch64
29BuildRequires: protobuf-devel protobuf-compiler36BuildRequires: protobuf-devel protobuf-compiler
@@ -91,6 +98,13 @@ tar -mxf %{SOURCE6} -C %{_builddir}/%{name}-%{version}/%{name}-prep_dir
91pushd %{_builddir}/%{name}-%{version}/%{name}-prep_dir/grpc-java-1.56.098pushd %{_builddir}/%{name}-%{version}/%{name}-prep_dir/grpc-java-1.56.0
92%patch1002 -p199%patch1002 -p1
93%patch1005 -p1100%patch1005 -p1
101+%patch -P 1006 -p1
102+%patch -P 1007 -p1
103+%patch -P 1008 -p1
104+%patch -P 1009 -p1
105+%patch -P 1010 -p1
106+%patch -P 1011 -p1
107+%patch -P 1012 -p1
94sed -i "s,@HOME@,${HOME},g" build.gradle108sed -i "s,@HOME@,${HOME},g" build.gradle
95sed -i 's|https\\://services.gradle.org/distributions|file://%{_tmppath}/source|g' gradle/wrapper/gradle-wrapper.properties109sed -i 's|https\\://services.gradle.org/distributions|file://%{_tmppath}/source|g' gradle/wrapper/gradle-wrapper.properties
96%ifarch riscv64110%ifarch riscv64
@@ -125,6 +139,9 @@ cp -rf ../%{name}-%{version} %{buildroot}/opt/apache-%{name}-%{version}
125 139 
126 140 
127%changelog141%changelog
142+* Mon Aug 24 2026 chenyanpan <chenyanpan@xfusion.com> - 3.5.0-7
143+- Fix CVE-2022-31777 CVE-2023-22946 CVE-2023-32007 CVE-2025-55039
144+ 
128* Wed Oct 15 2025 Wenlong Zhang <zhangwenlong@loongson.cn> - 3.5.0-6145* Wed Oct 15 2025 Wenlong Zhang <zhangwenlong@loongson.cn> - 3.5.0-6
129- fix build error on loongarch64146- fix build error on loongarch64
130 147