PT-2023-18751 · Apache · Apache Airflow Odbc Provider

Happyhacking + 1 · Published 2023-06-29 · Updated 2024-10-07 · CVE-2023-22886

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow JDBC Provider versions prior to 4.0.0

Description The issue is related to improper input validation in the Apache Airflow JDBC Provider, specifically in the Connection URL parameters of the Airflow JDBC Provider Connection, which had no restrictions. This made it possible to implement Remote Code Execution (RCE) attacks via different types of JDBC drivers, allowing attackers to obtain Airflow server permission.

Recommendations For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Connection URL parameters to minimize the risk of exploitation. Avoid using the Connection URL parameter in the affected Airflow JDBC Provider Connection until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-22886

GHSA-MM87-C3X2-6F89

Affected Products

Apache Airflow Odbc Provider

References · 7

• https://osv.dev/vulnerability/GHSA-mm87-c3x2-6f89 · Vendor Advisory
• https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-22886 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22886 · Security Note
• https://github.com/apache/airflow · Note
• https://t.me/cvenotify/53297 · Telegram Post
• https://t.me/cvenotify/53302 · Telegram Post