About jeromedruais

jeromedruais · ‎04-18-2023

Hello @rki_ , as we stil have some clusters running with HDP 2.6.5 (HDP 2.6.5.363-1)for some months before moving to CDP, does exist workarounds to mitigate this CVE ? Thanks in advance for your answer.

jeromedruais · ‎10-11-2022

Hello @rki as I can't find those parameters into Ambari, is it possible to enforce disabling it spark.enable.acls = false into Ambari (Custom Spark-defaults) ? Or maybe it's not be possible to expose by Ambari at all ! Thanks in advance.

jeromedruais · ‎09-28-2022

Hi @rki_ , unfortunately, on my kerberos cluster (HDP 2.6.5), I can't find it in Spark from Ambari. Do I need to activate them specifically into custom Spark configs even it's disabled (false) by default ?

jeromedruais · ‎09-27-2022

Hello @rki_ , how could we saw or configure it to disable acls ? Thanks for your answer.

jeromedruais · ‎09-26-2022

Hello @jagadeesan , @rki_ parameters you mentioned do not appear in Ambari. Does that mean our clusters are running with the default settings, exposing the clusters to the vulnerability ? Please, could you provide the way to set this parameters (which custom settings for Spark 1 and Spark 2 as well as the keys and values). Thanks in advance.

jeromedruais · ‎09-20-2022

Hello, parameters you mentioned do not appear in Ambari. Does that mean our clusters are running with the default settings, exposing the clusters to the vulnerability ? Please, could you provide the way to set this parameters (which custom settings for Spark 1 and Spark 2 as well as the keys and values). Thanks in advance.

jeromedruais · ‎09-02-2022

Thanks for this answer I haven't seen before today. Does the community should provide a fix for Spark 2 versions ?

jeromedruais · ‎07-26-2022

Hello, I would like to know if this CVE which impacts Apache Hadoop is already resolve into HDP or CDP products ? In Apache Hadoop 2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, and 3.3.0 to 3.3.1, a user who can escalate to yarn user can possibly run arbitrary commands as root user. Users should upgrade to Apache Hadoop 2.10.2, 3.2.3, 3.3.2 or higher. https://nvd.nist.gov/vuln/detail/CVE-2021-33036 Thanks in advance for your help.

jeromedruais · ‎07-26-2022

Thanks @jagadeesan for your answer. So, will you provide fixes for any HDP or CDP version to mitigate this issue ?

jeromedruais · ‎07-22-2022

Hello, a new CVE appears on Apache Spark. Does it impact every versions of Spark ? https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33891 Thanks in advance for your help.

Online	Offline
Last Visited	‎06-15-2023 09:49 AM

Member Since	‎05-25-2020 08:34 AM
Last Visited	‎06-15-2023 09:49 AM
Posts	12

Cloudera Community

Re: CVE-2022-25168

Re: Are there any effects of Spark2 by CVE-2022-33...

Re: Are there any effects of Spark2 by CVE-2022-33...

Re: Are there any effects of Spark2 by CVE-2022-33...

Re: CVE-2022-33891

Re: CVE-2022-33891

Re: CVE-2022-33891

CVE-2021-33036

Re: CVE-2022-33891

CVE-2022-33891