PT-2023-25319 · Apache · Apache Airflow Hive Provider

Id_No2015429 · Publicado 2023-07-03 · Atualizado 2024-10-07 · CVE-2023-35797

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow Hive Provider versions prior to 6.1.1

Description The issue is related to improper input validation, which allows bypassing a security check, potentially leading to remote code execution (RCE) via the principal parameter. This can be exploited if an attacker has access to modify connection details.

Recommendations For versions prior to 6.1.1, update the provider version to 6.1.1 to avoid this issue. As a temporary workaround, consider restricting access to modifying connection details to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-35797

GHSA-HG6C-QQCM-R79R

Produtos afetados

Apache Airflow Hive Provider

Referências · 12

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/31983 · Correção
• https://github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35797 · Nota de Segurança
• https://t.me/cvenotify/53552 · Publicação no Telegram
• https://t.me/cibsecurity/65857 · Publicação no Telegram
• https://t.me/cibsecurity/66632 · Publicação no Telegram
• https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hg6c-qqcm-r79r · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/07/12/3 · Nota
• https://t.me/cvenotify/97038 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-35797 · Aviso do Fabricante