PT-2023-4091 · Apache · Apache Airflow

Hungtd · Publicado 2023-07-11 · Atualizado 2026-02-20 · CVE-2023-36543

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue is related to the use of a regular expression with inefficient computational complexity in Apache Airflow, which can be exploited by a remote attacker to cause a denial of service. An authenticated user can use crafted input to make the current request hang.

Recommendations For versions prior to 2.6.3, upgrade to a version that is not affected to resolve the issue. As a temporary workaround, consider restricting access to the affected functionality to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-1333

CWE-20

Identificadores relacionados

BDU:2023-04393

BIT-AIRFLOW-2023-36543

CVE-2023-36543

GHSA-3H4M-M55V-GX4M

PYSEC-2023-106

Produtos afetados

Apache Airflow

Referências · 17

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/32060 · Correção
• https://github.com/apache/airflow/commit/116e607ddcb32480e57c342f48226545ac6fc315 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-106.yaml · Nota
• https://osv.dev/vulnerability/GHSA-3h4m-m55v-gx4m · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36543 · Nota de Segurança
• https://t.me/cvenotify/54830 · Publicação no Telegram
• https://bdu.fstec.ru/vul/2023-04393 · Nota de Segurança
• https://t.me/cvenotify/54778 · Publicação no Telegram
• https://t.me/cvenotify/55598 · Publicação no Telegram
• https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-36543 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-36543 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-airflow-2023-36543 · Aviso do Fabricante
• https://t.me/cibsecurity/66523 · Publicação no Telegram