PT-2023-8623 · Apache · Apache Airflow

Happyhacking · Publicado 2023-09-12 · Atualizado 2026-02-20 · CVE-2023-40611

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions before 2.7.1

Description The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start dates.

Recommendations For Apache Airflow versions before 2.7.1, users should upgrade to version 2.7.1 or later, which has removed the vulnerability.

Correção

DoS

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

BDU:2024-01276

BIT-AIRFLOW-2023-40611

CVE-2023-40611

GHSA-WPG8-MF6H-GM92

PYSEC-2023-170

Produtos afetados

Apache Airflow

Referências · 24

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/33413 · Correção, Aviso do Fabricante
• https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad · Nota
• https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml · Nota
• https://t.me/cvenotify/126628 · Publicação no Telegram
• https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-01276 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-wpg8-mf6h-gm92 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-40611 · Nota de Segurança
• https://t.me/cvenotify/67545 · Publicação no Telegram
• https://t.me/cvenotify/60810 · Publicação no Telegram
• http://openwall.com/lists/oss-security/2023/11/12/1 · Nota
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-40611 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-40611 · Aviso do Fabricante