GHSA-85pf-r4c7-3j9r

Apache Airflow Drill Provider vulnerable to improper input validation

En bref

Publiée: 2023-04-07 15:30 UTC
Mise à jour: 2026-07-07 17:57 UTC
CVE: CVE-2023-28707
Alias: PYSEC-2023-3, PYSEC-2026-1136
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Apache Software Foundation's Apache Airflow Drill Provider before 2.3.2 is vulnerable to improper input validation because the host passed in drill connection is not sanitized.

Paquets affectés

Paquet	Versions
PyPI · apache-airflow-providers-apache-drill	introduced 0, fixed 2.3.2

Références

https://nvd.nist.gov/vuln/detail/CVE-2023-28707 ADVISORY
https://github.com/apache/airflow/pull/30215 WEB
https://github.com/apache/airflow/commit/63d9b24aad0b4b9397682ddac1ea5824354789b3 WEB
https://github.com/apache/airflow PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-3.yaml WEB
https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk WEB
https://www.openwall.com/lists/oss-security/2023/04/07/1 WEB
http://www.openwall.com/lists/oss-security/2023/04/07/1 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database