PT-2023-8628 · Apache · Apache Airflow

Balis0Ng + 1 · Published 2023-10-14 · Updated 2024-03-06 · CVE-2023-42663

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.7.2

Description The issue allows an authorized user with access to read specific DAGs only to read information about task instances in other DAGs. This is due to a lack of protection for internal data. Exploitation of this issue may allow a remote attacker to gain read access to data.

Recommendations For versions prior to 2.7.2, upgrade to version 2.7.2 or newer to mitigate the risk associated with this issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-01281

BIT-AIRFLOW-2023-42663

CVE-2023-42663

GHSA-32WR-QQW6-5MFP

PYSEC-2023-197

Affected Products

Apache Airflow

References · 16

• https://github.com/apache/airflow/pull/34315 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-42663 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2023-42663 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-32wr-qqw6-5mfp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42663 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01281 · Security Note
• https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-197 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-197.yaml · Note
• https://t.me/cvenotify/59486 · Telegram Post
• https://t.me/cibsecurity/72283 · Telegram Post
• http://openwall.com/lists/oss-security/2023/11/12/2 · Note
• https://t.me/cvenotify/60809 · Telegram Post
• https://t.me/defcon_news/119642 · Telegram Post