PT-2023-8626 · Apache · Apache Airflow

Hussein Awala + 1 · Publicado 2023-10-14 · Atualizado 2024-05-01 · CVE-2023-45348

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.7.0 through 2.7.1

Description The issue allows an authenticated user to retrieve sensitive configuration information when the expose config option is set to "non-sensitive-only". The expose config option is False by default. Approximately 39,118 devices may be affected.

Recommendations For Apache Airflow versions 2.7.0 and 2.7.1, it is recommended to upgrade to a version that is not affected. As a temporary workaround, consider setting the expose config option to False to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2024-01279

BIT-AIRFLOW-2023-45348

CVE-2023-45348

GHSA-FPXX-XV4C-GXQP

PYSEC-2023-204

Produtos afetados

Apache Airflow

Referências · 19

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/34712 · Correção
• https://github.com/apache/airflow/commit/a4a0b5dd3d0ce05311c70bb9a32b66a650dbc0b4 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-204.yaml · Nota
• https://t.me/cibsecurity/72788 · Publicação no Telegram
• https://github.com/advisories/GHSA-fpxx-xv4c-gxqp · Nota
• https://t.me/cvenotify/59483 · Publicação no Telegram
• https://twitter.com/NUYTSTECH/status/1714557442322034962 · Publicação no Twitter
• https://t.me/cvenotify/78741 · Publicação no Telegram
• https://osv.dev/vulnerability/PYSEC-2023-204 · Aviso do Fabricante
• https://twitter.com/zoomeye_team/status/1714108888537321833 · Publicação no Twitter
• https://bdu.fstec.ru/vul/2024-01279 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-45348 · Nota de Segurança
• https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9 · Aviso do Fabricante
• https://t.me/cibsecurity/72280 · Publicação no Telegram