CVE-2022-33891

Hi @jeromedruais, this is a snown security issue CVE-2022-33891: Apache Spark shell command injection vulnerability via Spark UI reported in https://spark.apache.org/security.html

For mitigation, update to Spark 3.1.3, 3.2.2, or 3.3.0 or later

Thanks @jagadeesan for your answer.
So, will you provide fixes for any HDP or CDP version to mitigate this issue ?

@jeromedruais  Cluster is affected by the CVE-2022-33891 if only when the GroupMappingServiceProvider is called, i.e., when spark.history.ui.acls.enable / spark.acls.enable is enabled. Please make sure you have not enabled any Spark ACLs in your cluster. To verify you can check parameter settings via Ambari or Cloudera Manager UI -> spark configurations -> search for parameter spark.history.ui.acls.enable / spark.acls.enable and check if the value is enabled or disabled. To mitigate this issue you can disable Spark ACLs. 

@jeromedruais Has the reply helped resolve your issue? If so, please mark the appropriate reply as the solution, as it will make it easier for others to find the answer in the future. Thanks!