PT-2023-6914 · Apache · Apache Airflow

Augusto Hidalgo + 1 · Published 2023-11-12 · Updated 2024-03-06 · CVE-2023-47037

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.3

Description The issue allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes, potentially altering details such as configuration parameters and start dates. This is related to improper authorization in the Apache Airflow network programming tool.

Recommendations For versions prior to 2.7.3, upgrade to version 2.7.3 or later, which has removed the vulnerability. As a temporary workaround, consider restricting access to modify DAG run details for authenticated and DAG-view authorized users until the upgrade is applied.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

BDU:2023-07932

BIT-AIRFLOW-2023-47037

CVE-2023-47037

GHSA-HM9R-7F84-25C9

PYSEC-2023-232

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/33413 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2023-47037 · Vendor Advisory
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-47037 · Security Note
• https://bdu.fstec.ru/vul/2023-07932 · Security Note
• https://osv.dev/vulnerability/GHSA-hm9r-7f84-25c9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-232 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47037 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef · Note
• https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml · Note
• https://t.me/cvenotify/60810 · Telegram Post
• https://security.snyk.io/vuln/SNYK-PYTHON-APACHEAIRFLOW-6056227 · Note
• https://t.me/defcon_news/120110 · Telegram Post