PT-2023-20278 · Apache · Apache Airflow

[e-mail] · Publicado 2023-05-08 · Atualizado 2026-02-20 · CVE-2023-25754

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.0

Description The issue is related to a Privilege Context Switching Error. This error affects the functionality of Apache Airflow, potentially allowing unauthorized access or actions due to incorrect handling of privileges during context switching.

Recommendations For versions prior to 2.6.0, update to version 2.6.0 or later to resolve the issue.

Correção

DoS

Enumeração de Fraquezas

CWE-270

Identificadores relacionados

BIT-AIRFLOW-2023-25754

CVE-2023-25754

GHSA-JCHM-FM4Q-C2FP

PYSEC-2023-59

Produtos afetados

Apache Airflow

Referências · 16

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/29506 · Correção
• https://github.com/apache/airflow/releases/tag/2.6.0 · Nota
• https://github.com/apache/airflow/commit/18347d36e67894604436f3ef47d273532683b473 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-59.yaml · Nota
• https://osv.dev/vulnerability/BIT-airflow-2023-25754 · Aviso do Fabricante
• https://lists.apache.org/thread/3y83gr0qb8t49ppfk4fb2yk7md8ltq4v · Aviso do Fabricante
• https://github.com/advisories/GHSA-jchm-fm4q-c2fp · Nota
• https://osv.dev/vulnerability/PYSEC-2023-59 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jchm-fm4q-c2fp · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/05/08/2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25754 · Nota de Segurança
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-25754 · Aviso do Fabricante
• https://t.me/cibsecurity/63420 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25754 · Aviso do Fabricante