PT-2023-6332 · Apache · Apache Airflow

Balis0Ng + 1 · Published 2023-10-13 · Updated 2024-03-06 · CVE-2023-42792

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.2

Description The issue allows an authenticated user with limited access to some DAGs to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus enabling the user to clear DAGs they shouldn't. This is related to the disclosure of information in the error data area. Exploitation of the vulnerability may allow a remote attacker to impact data integrity.

Recommendations For Apache Airflow versions prior to 2.7.2, upgrade to version 2.7.2 or newer to mitigate the risk associated with this issue.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

BDU:2023-07044

BIT-AIRFLOW-2023-42792

CVE-2023-42792

GHSA-J3W8-2P2H-MRR9

PYSEC-2023-203

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/34366 · Patch
• https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07044 · Security Note
• https://osv.dev/vulnerability/GHSA-j3w8-2p2h-mrr9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42792 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-203 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-42792 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42792 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-203.yaml · Note
• https://twitter.com/NUYTSTECH/status/1715279698354446831 · Twitter Post
• https://t.me/cibsecurity/72282 · Telegram Post
• http://openwall.com/lists/oss-security/2023/12/21/1 · Note
• https://t.me/cvenotify/64628 · Telegram Post
• https://t.me/cvenotify/64644 · Telegram Post