PT-2023-18751 · Apache · Apache Airflow Odbc Provider

Happyhacking + 1 · Publicado 2023-06-29 · Atualizado 2024-10-07 · CVE-2023-22886

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow JDBC Provider versions prior to 4.0.0

Description The issue is related to improper input validation in the Apache Airflow JDBC Provider, specifically in the Connection URL parameters of the Airflow JDBC Provider Connection, which had no restrictions. This made it possible to implement Remote Code Execution (RCE) attacks via different types of JDBC drivers, allowing attackers to obtain Airflow server permission.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Connection URL parameters to minimize the risk of exploitation. Avoid using the Connection URL parameter in the affected Airflow JDBC Provider Connection until the issue is resolved.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-22886

GHSA-MM87-C3X2-6F89

Produtos afetados

Apache Airflow Odbc Provider

Referências · 7

• https://github.com/apache/airflow · Nota
• https://t.me/cvenotify/53297 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22886 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-22886 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-mm87-c3x2-6f89 · Aviso do Fabricante
• https://t.me/cvenotify/53302 · Publicação no Telegram
• https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3 · Aviso do Fabricante