PT-2023-4588 · Apache+1 · Apache Airflow Ftp Provider+3

Martin Schobert · Published 2023-08-23 · Updated 2024-03-06 · CVE-2023-39441

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0 Apache Airflow SMTP Provider versions prior to 1.3.0 Apache Airflow IMAP Provider versions prior to 3.3.0

Description The issue is related to the validation of OpenSSL certificates. The default SSL context with the SSL library did not check a server's X.509 certificate, instead accepting any certificate. This could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.

Recommendations For Apache Airflow versions prior to 2.7.0, upgrade to Apache Airflow version 2.7.0 or newer. For Apache Airflow SMTP Provider versions prior to 1.3.0, upgrade to Apache Airflow SMTP Provider version 1.3.0 or newer. For Apache Airflow IMAP Provider versions prior to 3.3.0, upgrade to Apache Airflow IMAP Provider version 3.3.0 or newer.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2023-04995

BIT-AIRFLOW-2023-39441

CVE-2023-39441

GHSA-5F35-PQ34-C87Q

Affected Products

Apache Airflow

Apache Airflow Imap Provider

Apache Airflow Ftp Provider

Openssl

References · 17

• https://github.com/apache/airflow/pull/33070 · Patch
• https://github.com/apache/airflow/pull/33075 · Patch
• https://github.com/apache/airflow/pull/33108 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2023-39441 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39441 · Security Note
• http://openwall.com/lists/oss-security/2023/08/23/2 · Patch
• https://osv.dev/vulnerability/GHSA-5f35-pq34-c87q · Vendor Advisory
• https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39441 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04995 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/38fc9cd823feafd8ec61d5d5c7eddb9e9162f755 · Note
• https://github.com/apache/airflow/commit/3bd8f020e8b7bdeb7f618bdbdfb3557f117b29d3 · Note
• https://github.com/apache/airflow/commit/dbacacbd4d476da757de148a4e747924c34fd7fe · Note
• https://vuldb.com/ru/?id.237872 · Note