PT-2023-8627 · Apache · Apache Airflow

Balis0Ng + 1 · Published 2023-10-14 · Updated 2024-03-06 · CVE-2023-42780

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.2

Description The issue allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs, revealing the dag ids and the stack-traces of import errors for those DAGs with import errors.

Recommendations For Apache Airflow versions prior to 2.7.2, upgrade to version 2.7.2 or newer to mitigate the risk associated with this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-01280

BIT-AIRFLOW-2023-42780

CVE-2023-42780

GHSA-CGX2-RRMR-JX43

PYSEC-2023-202

Affected Products

Apache Airflow

References · 15

• https://github.com/apache/airflow/pull/34355 · Patch
• https://osv.dev/vulnerability/BIT-airflow-2023-42780 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42780 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-202 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01280 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42780 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cgx2-rrmr-jx43 · Vendor Advisory
• https://lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/cf4eb3fb9b5cf4a8369b890e39523d4c05eed161 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-202.yaml · Note
• https://t.me/cibsecurity/72284 · Telegram Post
• https://github.com/advisories/GHSA-cgx2-rrmr-jx43 · Note
• https://t.me/cvenotify/59485 · Telegram Post
• https://t.me/defcon_news/120104 · Telegram Post