PT-2023-4793 · Apache · Apache Airflow

Khoabda + 4 · Published 2023-08-23 · Updated 2026-02-20 · CVE-2023-37379

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.0

Description The issue is related to insufficient validation of incoming requests, allowing an authenticated user with Connection edit privileges to access connection information and exploit the test connection feature. This can lead to a denial of service (DoS) condition on the server by sending many requests. Malicious actors can also establish harmful connections with the server.

Recommendations For versions prior to 2.7.0, upgrade to version 2.7.0 or newer to mitigate the risk associated with this issue. As a temporary workaround, consider restricting access to the test connection feature until a patch is available. Administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

Fix

DoS

Resource Exhaustion

SSRF

Information Disclosure

Weakness Enumeration

CWE-400

CWE-918

CWE-200

Related Identifiers

BDU:2023-05244

BIT-AIRFLOW-2023-37379

CVE-2023-37379

GHSA-X2MH-8FMC-RQGH

PYSEC-2023-152

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/32052 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2023-37379 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x2mh-8fmc-rqgh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37379 · Security Note
• https://bdu.fstec.ru/vul/2023-05244 · Security Note
• https://lists.apache.org/thread/g5c9vcn27lr14go48thrjpo6f4vw571r · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37379 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2023-37379 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-152 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/e4c3ecf8ceaefa17525b495e4bcb5b2f41309603 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-152.yaml · Note
• http://openwall.com/lists/oss-security/2023/08/23/4 · Note
• https://twitter.com/fletch_ai/status/1696358771327447092 · Twitter Post
• https://t.me/cibsecurity/69076 · Telegram Post