CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41267 – Apache HDFS Provider error message suggested installation of incorrect pip package
https://notcve.org/view.php?id=CVE-2023-41267
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1 En el proveedor Apache Airflow HDFS, versiones anteriores a la 4.1.1, una información de documentación señalaba a los usuarios una instalación de paquete pip incorrecto. Como este nombre de paquete no fue reclamado, en teoría, un atacante podría reclamar este paquete y proporcionar el código que se ejecutaría cuando se instalara este paquete. Desde entonces, el equipo de Airflow se hizo cargo del paquete (neutralizando el riesgo) y corrigió las cadenas de documentos en la versión 4.1.1. • http://www.openwall.com/lists/oss-security/2023/09/14/3 https://github.com/apache/airflow/pull/33813 https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z • CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40712 – Apache Airflow: Secrets can be unmasked in the "Rendered Template"
https://notcve.org/view.php?id=CVE-2023-40712
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability. Apache Airflow, versiones anteriores a la 2.7.1, se ve afectada por una vulnerabilidad que permite a los usuarios autenticados que tienen acceso para ver la tarea/dag en la interfaz de usuario crear una URL, lo que podría llevar a desenmascarar la configuración secreta de la tarea que de otro modo estar enmascarado en la interfaz UI. Se recomienda encarecidamente a los usuarios que actualicen a la versión 2.7.1 o posterior, que ha eliminado la vulnerabilidad. • https://github.com/apache/airflow/pull/33512 https://github.com/apache/airflow/pull/33516 https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40611 – Apache Airflow Dag Runs Broken Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2023-40611
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability. Apache Airflow, versiones anteriores a 2.7.1, se ve afectada por una vulnerabilidad que permite a los usuarios autenticados y autorizados para DAG-view modificar algunos valores de detalles de ejecución de DAG al enviar notas. Esto podría hacer que alteren detalles como los parámetros de configuración, la fecha de inicio, etc. Los usuarios deben actualizar a la versión 2.7.1 o posterior, que ha eliminado la vulnerabilidad. • http://www.openwall.com/lists/oss-security/2023/11/12/1 https://github.com/apache/airflow/pull/33413 https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0 • CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40195 – Apache Airflow Spark Provider Deserialization Vulnerability RCE
https://notcve.org/view.php?id=CVE-2023-40195
Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users. To view the warning in the docs please visit https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html • https://github.com/apache/airflow/pull/33233 https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24 • CWE-502: Deserialization of Untrusted Data CWE-829: Inclusion of Functionality from Untrusted Control Sphere •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-27604 – Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability
https://notcve.org/view.php?id=CVE-2023-27604
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it. • https://github.com/apache/airflow/pull/33039 https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd • CWE-20: Improper Input Validation •