Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections.
It is recommended to upgrade to a version that is not affected.
This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
References
Link | Resource |
---|---|
https://github.com/apache/airflow/pull/33039 | Patch Vendor Advisory |
https://lists.apache.org/thread/lswlxf11do51ob7f6xyyg8qp3n7wdrgd | Mailing List Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: apache
Published: 2023-08-28T07:47:29.702Z
Updated: 2023-08-28T07:47:29.702Z
Reserved: 2023-03-04T16:47:10.813Z
Link: CVE-2023-27604
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-08-28T08:15:14.697
Modified: 2023-09-01T17:11:03.007
Link: CVE-2023-27604
JSON object: View
Redhat Information
No data.
CWE