PT-2023-20249 · Apache · Apache Airflow Google Provider

Xie Jianming · Publicado 2023-02-24 · Atualizado 2026-06-03 · CVE-2023-25692

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow Google Provider versions prior to 8.10.0

Description The issue is related to an Improper Input Validation vulnerability in the Apache Airflow Google Provider. This vulnerability can potentially lead to a Denial of Service and Remote Command Execution.

Recommendations For versions prior to 8.10.0, update to version 8.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Google Cloud Sql Provider to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-25692

GHSA-H8P2-8G72-QPGH

Produtos afetados

Apache Airflow Google Provider

Referências · 12

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/29499 · Correção
• https://t.me/breachdetector/207052 · Publicação no Telegram
• https://t.me/cvenotify/45632 · Publicação no Telegram
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-25692 · Aviso do Fabricante
• https://t.me/defcon_news/112205 · Publicação no Telegram
• https://t.me/cvenotify/114353 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25692 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25692 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h8p2-8g72-qpgh · Aviso do Fabricante
• https://t.me/cibsecurity/58861 · Publicação no Telegram
• https://lists.apache.org/thread/ks4l78l5rwdpmvfn7y7yhs179nyxtlsh · Aviso do Fabricante