CVE-2023-39553

Опубликовано: 11 авг. 2023

Источник: nvd

CVSS3: 7.5

EPSS Низкий

Описание

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.

Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected.

Ссылки

http://www.openwall.com/lists/oss-security/2023/08/11/1
Mailing List
Patch
Third Party Advisory
https://github.com/apache/airflow/pull/33074
Patch
https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf
Mailing List
Patch
Vendor Advisory
http://www.openwall.com/lists/oss-security/2023/08/11/1
Mailing List
Patch
Third Party Advisory
https://github.com/apache/airflow/pull/33074
Patch
https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf
Mailing List
Patch
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:apache-airflow-providers-apache-drill:*:*:*:*:*:*:*:*

Версия до 2.4.3 (исключая)

EPSS

Процентиль: 84%

0.02197

Низкий

7.5 High

CVSS3

Дефекты

CWE-20

Связанные уязвимости

GHSA-mq4v-6vg4-796c

CVSS3: 7.5

github

больше 2 лет назад

apache-airflow-providers-apache-drill Improper Input Validation vulnerability

BDU:2023-04764

CVSS3: 3.5

fstec