CVE-2024-29733
Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.
The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.
This issue affects Apache Airflow FTP Provider: before 3.7.0.
Users are recommended to upgrade to version 3.7.0, which fixes the issue.
Vulnerabilidad de validación de certificado incorrecta en el proveedor FTP Apache Airflow. El enlace FTP carece de una validación completa del certificado en las conexiones FTP_TLS, lo que potencialmente puede aprovecharse. La implementación de una validación de certificados adecuada pasando context=ssl.create_default_context() durante la creación de instancias de FTP_TLS se utiliza como mitigación para validar los certificados correctamente. Este problema afecta al proveedor FTP Apache Airflow: anterior a 3.7.0. Se recomienda a los usuarios actualizar a la versión 3.7.0, que soluciona el problema.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-03-19 CVE Reserved
- 2024-04-21 CVE Published
- 2024-04-22 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-295: Improper Certificate Validation
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2024/04/19/3 |
|
|
| https://docs.python.org/3/library/ssl.html#best-defaults | Technical Description | |
| https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 | Technical Description |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/apache/airflow/pull/38266 | 2024-07-03 |
| URL | Date | SRC |
|---|---|---|
| https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 | 2024-07-03 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Apache Software Foundation Search vendor "Apache Software Foundation" | Apache Airflow FTP Provider Search vendor "Apache Software Foundation" for product "Apache Airflow FTP Provider" | < 3.7.0 Search vendor "Apache Software Foundation" for product "Apache Airflow FTP Provider" and version " < 3.7.0" | en |
Affected
| ||||||