Advisoriesby IbisApache AirflowGHSA-8f57-wcmg-4jmh
Apache Airflow vulnerable to Exposure of Resource to Wrong Sphere
Fix: upgrade to 2.8.0 or later
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't.
This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2
Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.8.0 | 2.8.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-668
- Also known as
- BIT-airflow-2023-48291, CVE-2023-48291, PYSEC-2023-265
- nvd.nist.gov/vuln/detail/CVE-2023-48291
- github.com/apache/airflow/pull/34366
- github.com/apache/airflow/commit/4f1b500c47813c54349b7d3e48df0a444fb4826c
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-265.yaml
- lists.apache.org/thread/3nl0h014274yjlt1hd02z0q78ftyz0z3
- www.openwall.com/lists/oss-security/2023/12/21/1
More Apache Airflow advisories
All Apache Airflow
Apache Airflow: Bypass permission verification to read code of other dagsCVE-2023-50944fixed in 2.8.1rc1Apache Airflow: cleartext storageCVE-2023-51702fixed in 2.6.1Apache Airflow: pickle deserialization vulnerability in XComsCVE-2023-50943fixed in 2.8.1rc1Apache Airflow Improper Access Control vulnerabilityCVE-2023-50783fixed in 2.8.0Apache Airflow Cross-Site Request Forgery vulnerabilityCVE-2023-49920fixed in 2.8.0Apache Airflow has a stored cross-site scripting vulnerabilityCVE-2023-47265fixed in 2.8.0b1