CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37415 – Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user
https://notcve.org/view.php?id=CVE-2023-37415
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability. • http://www.openwall.com/lists/oss-security/2023/07/12/3 https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35797 – Apache Airflow Hive Provider Beeline RCE with Principal
https://notcve.org/view.php?id=CVE-2023-35797
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability. • http://www.openwall.com/lists/oss-security/2023/07/12/3 https://github.com/apache/airflow/pull/31983 https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25696 – Apache Airflow Hive Provider Beeline RCE
https://notcve.org/view.php?id=CVE-2023-25696
Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3. • https://github.com/apache/airflow/pull/29502 https://lists.apache.org/thread/99g0qm56wmgdxmbtdsvhj4rdnxhpzpml • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-46421 – Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params
https://notcve.org/view.php?id=CVE-2022-46421
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0. Neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando ("Inyección de comando") en Apache Software Foundation Apache Airflow Hive Provider. Este problema afecta a Apache Airflow Hive Provider: versiones anteriores a 5.0.0. • https://github.com/apache/airflow/pull/28101 https://lists.apache.org/thread/09twdoyoybldlfj5gvk0qswtofh0rmp4 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41131 – Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)
https://notcve.org/view.php?id=CVE-2022-41131
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed). Neutralización inadecuada de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo ('inyección de comando del sistema operativo') en Apache Airflow Hive Provider, Apache Airflow permite a un atacante ejecutar comandos arbitrarios en el contexto de ejecución de la tarea, sin acceso de escritura a los archivos DAG. • https://github.com/apache/airflow/pull/27647 https://lists.apache.org/thread/wwo3qp0z8gv54yzn7hr04wy4n8gb0vhl • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •