PT-2023-4091 · Apache · Apache Airflow

Hungtd · Published 2023-07-11 · Updated 2026-02-20 · CVE-2023-36543

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.6.3

Description The issue is related to the use of a regular expression with inefficient computational complexity in Apache Airflow, which can be exploited by a remote attacker to cause a denial of service. An authenticated user can use crafted input to make the current request hang.

Recommendations For versions prior to 2.6.3, upgrade to a version that is not affected to resolve the issue. As a temporary workaround, consider restricting access to the affected functionality to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-1333

CWE-20

Related Identifiers

BDU:2023-04393

BIT-AIRFLOW-2023-36543

CVE-2023-36543

GHSA-3H4M-M55V-GX4M

PYSEC-2023-106

Affected Products

Apache Airflow

References · 17

• https://github.com/apache/airflow/pull/32060 · Patch
• https://osv.dev/vulnerability/GHSA-3h4m-m55v-gx4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36543 · Security Note
• https://bdu.fstec.ru/vul/2023-04393 · Security Note
• https://lists.apache.org/thread/tokfs980504ylgk3cv3hjlnrtbv4tng4 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-36543 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36543 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-36543 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-106 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/116e607ddcb32480e57c342f48226545ac6fc315 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-106.yaml · Note
• https://t.me/cvenotify/54830 · Telegram Post
• https://t.me/cvenotify/54778 · Telegram Post
• https://t.me/cvenotify/55598 · Telegram Post