PT-2023-24858 · Apache · Apache Airflow Odbc Provider

Kmhlyxj0 · Published 2023-06-27 · Updated 2025-11-21 · CVE-2023-34395

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow ODBC Provider versions prior to 4.0.0

Description A privilege escalation vulnerability exists due to controllable ODBC driver parameters in OdbcHook, allowing the loading of arbitrary dynamic-link libraries and resulting in command execution. This issue is related to improper neutralization of argument delimiters in a command, also known as 'Argument Injection'. The vulnerability enables the execution of commands, potentially leading to system compromise.

Recommendations For versions prior to 4.0.0, consider restricting access to the OdbcHook and limiting the ability to load dynamic-link libraries until a fixed version is available. As a temporary workaround, restrict the use of controllable ODBC driver parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2023-34395

GHSA-9766-V29C-4VM7

Affected Products

Apache Airflow Odbc Provider

References · 10

• https://github.com/apache/airflow/pull/31713 · Patch
• https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34395 · Security Note
• https://osv.dev/vulnerability/GHSA-9766-v29c-4vm7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-34395 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-34395 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300 · Note
• https://t.me/cvenotify/53760 · Telegram Post
• https://t.me/cibsecurity/65569 · Telegram Post