CVSS: -EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49250 – Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil
https://notcve.org/view.php?id=CVE-2023-49250
Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Debido a que la clase HttpUtils no verificó los certificados, un atacante que pudiera realizar un ataque Man-in-the-Middle (MITM) en conexiones https salientes podría hacerse pasar por el servidor. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.0. Se recomienda a los usuarios actualizar a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/1 https://github.com/apache/dolphinscheduler/pull/15288 https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn • CWE-295: Improper Certificate Validation •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49109 – Remote Code Execution in Apache Dolphinscheduler
https://notcve.org/view.php?id=CVE-2023-49109
Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue. Exposición de la ejecución remota de código en Apache Dolphinscheduler. Este problema afecta a Apache DolphinScheduler: versiones anteriores a 3.2.1. Recomendamos a los usuarios que actualicen Apache DolphinScheduler a la versión 3.2.1, que soluciona el problema. • http://www.openwall.com/lists/oss-security/2024/02/20/4 https://github.com/apache/dolphinscheduler/pull/14991 https://lists.apache.org/thread/5b6yq2gov0fsy9x5dkvo8ws4rr45vkn8 https://lists.apache.org/thread/6kgsl93vtqlbdk6otttl0d8wmlspk0m5 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-23952 – Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)
https://notcve.org/view.php?id=CVE-2024-23952
This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Este es un duplicado de CVE-2023-46104. Con rangos de versión CVE correctos para Apache Superset afectado. • http://www.openwall.com/lists/oss-security/2024/02/14/2 http://www.openwall.com/lists/oss-security/2024/02/14/3 https://lists.apache.org/thread/zc58zvm4414molqn2m4d4vkrbrsxdksx • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2023-39441 – Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation
https://notcve.org/view.php?id=CVE-2023-39441
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability Apache Airflow SMTP Provider antes de 1.3.0, Apache Airflow IMAP Provider antes de 3.3.0, y Apache Airflow antes de 2.7.0 están afectados por la vulnerabilidad Validation of OpenSSL Certificate. El contexto SSL por defecto con la librería SSL no comprobaba el certificado X.509 de un servidor. En su lugar, el código aceptaba cualquier certificado, lo que podía dar lugar a la revelación de credenciales del servidor de correo o del contenido del correo cuando el cliente se conectaba a un atacante en posición MITM. Se recomienda encarecidamente a los usuarios que actualicen a Apache Airflow versión 2.7.0 o posterior, Apache Airflow IMAP Provider versión 3.3.0 o posterior y Apache Airflow SMTP Provider versión 1.3.0 o posterior para mitigar el riesgo asociado a esta vulnerabilidad. • http://www.openwall.com/lists/oss-security/2023/08/23/2 https://github.com/apache/airflow/pull/33070 https://github.com/apache/airflow/pull/33075 https://github.com/apache/airflow/pull/33108 https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40272 – Apache Airflow Spark Provider Arbitrary File Read via JDBC
https://notcve.org/view.php?id=CVE-2023-40272
Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected. • http://www.openwall.com/lists/oss-security/2023/08/17/1 http://www.openwall.com/lists/oss-security/2023/08/18/1 https://lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7 • CWE-20: Improper Input Validation •