PT-2023-4014 · Apache · Apache Airflow

Karthikeyan Singaravelan · Publicado 2023-07-11 · Atualizado 2026-02-20 · CVE-2023-35908

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue is related to improper authorization in Apache Airflow, allowing unauthorized read access to a DAG through a specially crafted URL. This could enable a remote attacker to disclose protected information.

Recommendations For versions prior to 2.6.3, upgrade to a version that is not affected to resolve the issue. As a temporary workaround, consider restricting access to the DAGs through the URL to minimize the risk of exploitation.

Correção

DoS

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2023-04312

BIT-AIRFLOW-2023-35908

CVE-2023-35908

GHSA-2H84-3CRQ-VGFJ

PYSEC-2023-119

Produtos afetados

Apache Airflow

Referências · 17

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/32014 · Correção
• https://github.com/apache/airflow/commit/ac65b82eeeeaa670e09a83c7da65cbac7e89f8db · Nota
• https://github.com/apache/airflow/commit/c78e16588ee399f6eaf60425eb1ad7fa6d3fe352 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-119.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-35908 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-119 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-35908 · Aviso do Fabricante
• https://lists.apache.org/thread/vsflptk5dt30vrfggn96nx87d7zr6yvw · Aviso do Fabricante
• https://github.com/advisories/GHSA-2h84-3crq-vgfj · Nota
• https://t.me/cvenotify/54773 · Publicação no Telegram
• https://t.me/cvenotify/54126 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-2h84-3crq-vgfj · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-04312 · Nota de Segurança
• https://t.me/cibsecurity/66530 · Publicação no Telegram