PT-2024-20775 · Apache · Apache-Airflow-Providers-Mongo

Noah Stapp · Published 2024-02-20 · Updated 2025-04-26 · CVE-2024-25141

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-mongo versions prior to 4.0.0

Description The issue arises when SSL is enabled for the Mongo Hook, and the default settings include allow insecure, which causes certificates not to be validated. This behavior is unexpected and undocumented.

Recommendations For versions prior to 4.0.0, upgrade to version 4.0.0 to fix the issue. As a temporary workaround, consider disabling the SSL setting for the Mongo Hook until the upgrade is applied. Restrict access to the Mongo Hook to minimize the risk of exploitation. Avoid using the allow insecure setting in the affected configuration until the issue is resolved.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-AIRFLOW-2024-25141

CVE-2024-25141

GHSA-X5PM-H33Q-CJRW

Affected Products

Apache-Airflow-Providers-Mongo

References · 13

• https://github.com/apache/airflow/pull/37214 · Patch
• https://osv.dev/vulnerability/GHSA-x5pm-h33q-cjrw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25141 · Vendor Advisory
• https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-25141 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25141 · Security Note
• https://github.com/apache/airflow · Note
• https://t.me/cvenotify/72047 · Telegram Post
• https://t.me/cvenotify/119871 · Telegram Post
• https://t.me/cvenotify/90812 · Telegram Post
• http://openwall.com/lists/oss-security/2024/02/20/5 · Note
• https://t.me/cvenotify/72049 · Telegram Post
• https://twitter.com/oss_security/status/1760354934724133275 · Twitter Post