PT-2024-3221 · Apache · Apache Airflow Ftp Provider

Eric Brown · Published 2024-03-18 · Updated 2025-07-10 · CVE-2024-29733

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apache Airflow FTP Provider versions prior to 3.7.0

Description The issue is related to improper certificate validation in FTP TLS connections, which can potentially be leveraged by an attacker. This can impact the confidentiality, integrity, and availability of protected information. The FTP hook lacks complete certificate validation, allowing for potential exploitation. Implementing proper certificate validation by passing context=ssl.create default context() during FTP TLS instantiation can be used as mitigation to validate certificates properly.

Recommendations To fix the issue, upgrade to version 3.7.0, which includes the necessary fixes for proper certificate validation. As a temporary workaround, consider implementing proper certificate validation by passing context=ssl.create default context() during FTP TLS instantiation to validate certificates properly.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2024-03447

CVE-2024-29733

GHSA-3GG8-MC87-CQ3H

Affected Products

Apache Airflow Ftp Provider

References · 14

• https://github.com/apache/airflow/pull/38266 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29733 · Security Note
• https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3gg8-mc87-cq3h · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03447 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29733 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 · Note
• https://docs.python.org/3/library/ssl.html#best-defaults · Note
• https://vuldb.com/ru/?id.261591 · Note
• https://t.me/cvenotify/77584 · Telegram Post
• https://t.me/cvenotify/128413 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1798708924948025417 · Twitter Post
• http://openwall.com/lists/oss-security/2024/04/19/3 · Note