PT-2023-4070 · Apache · Apache Airflow

Elad Kalif · Publicado 2023-05-26 · Atualizado 2024-10-10 · CVE-2023-33234

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow CNCF Kubernetes provider version 5.0.0

Description The issue is related to a weakness in the procedure for neutralizing special elements in output, which can allow an attacker to execute arbitrary code. This can be exploited by a user with elevated permissions (Op or Admin) to change the connection object, allowing them to change the xcom sidecar image and resources via Airflow connection.

Recommendations Upgrade to provider version 7.0.0, which has removed the vulnerability.

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

BDU:2023-04368

CVE-2023-33234

GHSA-2RX4-9F5H-9GJF

Produtos afetados

Apache Airflow

Referências · 8

• https://github.com/apache/airflow · Nota
• https://osv.dev/vulnerability/GHSA-2rx4-9f5h-9gjf · Aviso do Fabricante
• https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-33234 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-33234 · Nota de Segurança
• https://t.me/cvenotify/97766 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04368 · Nota de Segurança
• https://t.me/cibsecurity/64781 · Publicação no Telegram