PT-2023-4070 · Apache · Apache Airflow

Elad Kalif · Published 2023-05-26 · Updated 2024-10-10 · CVE-2023-33234

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow CNCF Kubernetes provider version 5.0.0

Description The issue is related to a weakness in the procedure for neutralizing special elements in output, which can allow an attacker to execute arbitrary code. This can be exploited by a user with elevated permissions (Op or Admin) to change the connection object, allowing them to change the xcom sidecar image and resources via Airflow connection.

Recommendations Upgrade to provider version 7.0.0, which has removed the vulnerability.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2023-04368

CVE-2023-33234

GHSA-2RX4-9F5H-9GJF

Affected Products

Apache Airflow

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-33234 · Security Note
• https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rx4-9f5h-9gjf · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04368 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33234 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://t.me/cibsecurity/64781 · Telegram Post
• https://t.me/cvenotify/97766 · Telegram Post