Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
References
Link | Resource |
---|---|
https://github.com/apache/airflow/pull/31713 | Patch |
https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd | Mailing List Vendor Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: apache
Published: 2023-06-27T11:36:58.116Z
Updated: 2023-06-27T11:36:58.116Z
Reserved: 2023-06-03T15:26:13.230Z
Link: CVE-2023-34395
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-06-27T12:15:13.187
Modified: 2023-07-06T13:38:18.830
Link: CVE-2023-34395
JSON object: View
Redhat Information
No data.
CWE