PT-2023-4793 · Apache · Apache Airflow

Khoabda + 4 · Publicado 2023-08-23 · Atualizado 2026-02-20 · CVE-2023-37379

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0

Description The issue is related to insufficient validation of incoming requests, allowing an authenticated user with Connection edit privileges to access connection information and exploit the test connection feature. This can lead to a denial of service (DoS) condition on the server by sending many requests. Malicious actors can also establish harmful connections with the server.

Recommendations For versions prior to 2.7.0, upgrade to version 2.7.0 or newer to mitigate the risk associated with this issue. As a temporary workaround, consider restricting access to the test connection feature until a patch is available. Administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

Correção

DoS

Resource Exhaustion

SSRF

Information Disclosure

Enumeração de Fraquezas

CWE-400

CWE-918

CWE-200

Identificadores relacionados

BDU:2023-05244

BIT-AIRFLOW-2023-37379

CVE-2023-37379

GHSA-X2MH-8FMC-RQGH

PYSEC-2023-152

Produtos afetados

Apache Airflow

Referências · 16

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/32052 · Correção
• https://github.com/apache/airflow/commit/e4c3ecf8ceaefa17525b495e4bcb5b2f41309603 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-152.yaml · Nota
• https://osv.dev/vulnerability/BIT-airflow-2023-37379 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x2mh-8fmc-rqgh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-37379 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05244 · Nota de Segurança
• http://openwall.com/lists/oss-security/2023/08/23/4 · Nota
• https://twitter.com/fletch_ai/status/1696358771327447092 · Publicação no Twitter
• https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r · Aviso do Fabricante
• https://t.me/cibsecurity/69076 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-37379 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-37379 · Aviso do Fabricante
• https://github.com/advisories/GHSA-x2mh-8fmc-rqgh · Nota