PT-2023-4588 · Apache+1 · Apache Airflow+3

Martin Schobert · Publicado 2023-08-23 · Atualizado 2024-03-06 · CVE-2023-39441

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0 Apache Airflow SMTP Provider versions prior to 1.3.0 Apache Airflow IMAP Provider versions prior to 3.3.0

Description The issue is related to the validation of OpenSSL certificates. The default SSL context with the SSL library did not check a server's X.509 certificate, instead accepting any certificate. This could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.

Recommendations For Apache Airflow versions prior to 2.7.0, upgrade to Apache Airflow version 2.7.0 or newer. For Apache Airflow SMTP Provider versions prior to 1.3.0, upgrade to Apache Airflow SMTP Provider version 1.3.0 or newer. For Apache Airflow IMAP Provider versions prior to 3.3.0, upgrade to Apache Airflow IMAP Provider version 3.3.0 or newer.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

BDU:2023-04995

BIT-AIRFLOW-2023-39441

CVE-2023-39441

GHSA-5F35-PQ34-C87Q

Produtos afetados

Apache Airflow

Apache Airflow Imap Provider

Apache Airflow Ftp Provider

Openssl

Referências · 17

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/33070 · Correção
• https://github.com/apache/airflow/pull/33075 · Correção
• https://github.com/apache/airflow/pull/33108 · Correção
• https://github.com/apache/airflow/commit/38fc9cd823feafd8ec61d5d5c7eddb9e9162f755 · Nota
• https://github.com/apache/airflow/commit/3bd8f020e8b7bdeb7f618bdbdfb3557f117b29d3 · Nota
• https://github.com/apache/airflow/commit/dbacacbd4d476da757de148a4e747924c34fd7fe · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39441 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04995 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/08/23/2 · Correção
• https://vuldb.com/ru/?id.237872 · Nota
• https://t.me/cibsecurity/69073 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-5f35-pq34-c87q · Aviso do Fabricante
• https://github.com/advisories/GHSA-5f35-pq34-c87q · Nota
• https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb · Aviso do Fabricante