PT-2023-3656 · Apache · Apache Airflow Mysql Provider+1

Id_No2015429 · Published 2023-06-26 · Updated 2023-07-06 · CVE-2023-35798

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow ODBC Provider versions prior to 4.0.0 Apache Airflow MSSQL Provider versions prior to 3.4.1

Description The issue is related to insufficient input validation in the Apache Airflow MSSQL Provider and Airflow ODBC Provider modules. This allows a remote attacker to access protected information. The vulnerability is considered low because it requires DAG code to use get sqlalchemy connection and someone with access to connection resources to update the connection and exploit it.

Recommendations For Apache Airflow ODBC Provider versions prior to 4.0.0, upgrade to a version that is not affected. For Apache Airflow MSSQL Provider versions prior to 3.4.1, upgrade to a version that is not affected. As a temporary workaround, consider restricting access to the get sqlalchemy connection function until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-03940

CVE-2023-35798

GHSA-Q57W-826P-46JR

Affected Products

Apache Airflow Mysql Provider

Apache Airflow Odbc Provider

References · 11

• https://osv.dev/vulnerability/GHSA-q57w-826p-46jr · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03940 · Security Note
• https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-35798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35798 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/pull/31984 · Vendor Advisory, Patch
• https://github.com/apache/airflow/commit/b6836986846058e9e5fa271fb7b22ae721020787 · Note
• https://t.me/cibsecurity/65570 · Telegram Post
• https://vuldb.com/ru/?id.232387 · Note
• https://cybersecurity-help.cz/vdb/SB2023070530 · Note