PT-2023-6914 · Apache · Apache Airflow

Augusto Hidalgo + 1 · Publicado 2023-11-12 · Atualizado 2024-03-06 · CVE-2023-47037

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.3

Description The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start dates. This is related to improper authorization in the Apache Airflow network programming tool.

Recommendations For versions prior to 2.7.3, upgrade to version 2.7.3 or later, which has removed the vulnerability. As a temporary workaround, consider restricting access to modify DAG run details for authenticated and DAG-view authorized users until the upgrade is applied.

Correção

DoS

Incorrect Authorization

Improper Authorization

Enumeração de Fraquezas

CWE-863

CWE-285

Identificadores relacionados

BDU:2023-07932

BIT-AIRFLOW-2023-47037

CVE-2023-47037

GHSA-HM9R-7F84-25C9

PYSEC-2023-232

Produtos afetados

Apache Airflow

Referências · 17

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/33413 · Correção
• https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad · Nota
• https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-47037 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-232 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-airflow-2023-47037 · Aviso do Fabricante
• https://t.me/defcon_news/120110 · Publicação no Telegram
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 · Aviso do Fabricante
• https://t.me/cvenotify/60810 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/11/12/1 · Nota
• https://osv.dev/vulnerability/CVE-2023-47037 · Aviso do Fabricante
• https://security.snyk.io/vuln/SNYK-PYTHON-APACHEAIRFLOW-6056227 · Nota
• https://github.com/advisories/GHSA-hm9r-7f84-25c9 · Nota