Apache Airflow Spark Provider Deserialization Vulnerability RCE

Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users. To view the warning in the docs please visit  https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html

N/A

可信数据的反序列化

Apache Airflow 安全漏洞

Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow Spark Provider 1.3 之前版本存在安全漏洞，该漏洞源于当 Apache Spark 提供程序安装在 Airflow 部署上时，有权配置 Spark hooks 的 Airflow 用户可以通过将 Airflow 节点指向恶意 Spark 服务器来在 Airflow 节点上运行任意代码。

N/A

N/A