PT-2023-24858 · Apache · Apache Airflow Odbc Provider

Kmhlyxj0 · Publicado 2023-06-27 · Atualizado 2026-06-03 · CVE-2023-34395

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow ODBC Provider versions prior to 4.0.0

Description A privilege escalation vulnerability exists due to controllable ODBC driver parameters in OdbcHook, allowing the loading of arbitrary dynamic-link libraries and resulting in command execution. This issue is related to improper neutralization of argument delimiters in a command, also known as 'Argument Injection'. The vulnerability enables the execution of commands, potentially leading to system compromise.

Recommendations For versions prior to 4.0.0, consider restricting access to the OdbcHook and limiting the ability to load dynamic-link libraries until a fixed version is available. As a temporary workaround, restrict the use of controllable ODBC driver parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2023-34395

GHSA-9766-V29C-4VM7

Produtos afetados

Apache Airflow Odbc Provider

Referências · 10

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300 · Nota
• https://github.com/apache/airflow/pull/31713 · Correção
• https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-9766-v29c-4vm7 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34395 · Nota de Segurança
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-34395 · Aviso do Fabricante
• https://t.me/cibsecurity/65569 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-34395 · Aviso do Fabricante
• https://t.me/cvenotify/53760 · Publicação no Telegram