GHSA-wpg8-mf6h-gm92
Apache Airflow Incorrect Authorization vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-40611
- Alias
- BIT-airflow-2023-40611, PYSEC-2023-170
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Description
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 2.7.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-40611 ADVISORY
- https://github.com/apache/airflow/pull/33413 WEB
- https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad WEB
- https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml WEB
- https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0 WEB
- http://www.openwall.com/lists/oss-security/2023/11/12/1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |