PT-2023-4783 · Apache · Apache Airflow

Balis0Ng · Publicado 2023-08-04 · Atualizado 2026-02-20 · CVE-2023-39508

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.0

Description The issue is related to the "Run Task" feature in Apache Airflow, which allows an authenticated user to bypass some restrictions and execute code in the webserver context, as well as access certain DAGs beyond their limitations. This feature is considered dangerous and has been removed entirely in Airflow 2.6.0. The vulnerability can lead to exposure of sensitive information to unauthorized actors.

Recommendations For Apache Airflow versions prior to 2.6.0, consider updating to version 2.6.0 or later, where the "Run Task" feature has been removed entirely. As a temporary workaround, consider disabling the "Run Task" feature to minimize the risk of exploitation. Restrict access to the webserver context and certain DAGs to prevent unauthorized access.

Correção

DoS

Information Disclosure

Enumeração de Fraquezas

CWE-250

CWE-200

Identificadores relacionados

BDU:2023-05231

BIT-AIRFLOW-2023-39508

CVE-2023-39508

GHSA-269X-PG5C-5XGM

PYSEC-2023-134

Produtos afetados

Apache Airflow

Referências · 20

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/29706 · Correção, Aviso do Fabricante
• https://github.com/apache/airflow/commit/101d59c4b88ab979d305b8d96f612c27c8a44aa8 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-134.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39508 · Nota de Segurança
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-39508 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-134 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-airflow-2023-39508 · Aviso do Fabricante
• https://t.me/cvenotify/96829 · Publicação no Telegram
• https://t.me/cvenotify/55845 · Publicação no Telegram
• https://github.com/advisories/GHSA-269x-pg5c-5xgm · Nota
• https://bdu.fstec.ru/vul/2023-05231 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-269x-pg5c-5xgm · Aviso do Fabricante
• https://twitter.com/devcentral/status/1724291219457532116 · Publicação no Twitter
• https://t.me/cvenotify/55843 · Publicação no Telegram