CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40272 – Apache Airflow Spark Provider Arbitrary File Read via JDBC
https://notcve.org/view.php?id=CVE-2023-40272
17 Aug 2023 — Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected. Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Ai... • http://www.openwall.com/lists/oss-security/2023/08/17/1 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 1%CPEs: 1EXPL: 0CVE-2023-39553 – Apache Airflow Drill Provider Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-39553
11 Aug 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected. Improper Input Validation vulnerability in Apache Software Fo... • http://www.openwall.com/lists/oss-security/2023/08/11/1 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37415 – Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user
https://notcve.org/view.php?id=CVE-2023-37415
13 Jul 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability. Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. • http://www.openwall.com/lists/oss-security/2023/07/12/3 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35797 – Apache Airflow Hive Provider Beeline RCE with Principal
https://notcve.org/view.php?id=CVE-2023-35797
03 Jul 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability. Improper Input Validation vulnerability in Apache Software Foundation Ap... • http://www.openwall.com/lists/oss-security/2023/07/12/3 • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-22886 – Apache Airflow JDBC Provider: RCE Vulnerability
https://notcve.org/view.php?id=CVE-2023-22886
29 Jun 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission. This issue affects Apache Airflow JDBC Provider: before 4.0.0. Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL... • https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2023-35798 – Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-35798
27 Jun 2023 — Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not aff... • https://github.com/apache/airflow/pull/31984 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34395 – Apache Airflow ODBC Provider: Remote code execution vulnerability
https://notcve.org/view.php?id=CVE-2023-34395
27 Jun 2023 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0. Improper Neutra... • https://github.com/apache/airflow/pull/31713 • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28710 – Apache Airflow Spark Provider Arbitrary File Read via JDBC
https://notcve.org/view.php?id=CVE-2023-28710
07 Apr 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1. • http://www.openwall.com/lists/oss-security/2023/04/07/3 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-28707 – Airflow Apache Drill Provider Arbitrary File Read Vulnerability
https://notcve.org/view.php?id=CVE-2023-28707
07 Apr 2023 — Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2. • http://www.openwall.com/lists/oss-security/2023/04/07/1 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-25956 – Apache Airflow AWS Provider: Arbitrary file read via AWS provider
https://notcve.org/view.php?id=CVE-2023-25956
24 Feb 2023 — Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider. This issue affects Apache Airflow AWS Provider versions before 7.2.1. • https://github.com/apache/airflow/pull/29587 • CWE-209: Generation of Error Message Containing Sensitive Information •