CVE-2023-35798

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

EPSS 1.3%CWE-20

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 1.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

27 Jun 2023Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not affected

Affected products

Apache Software Foundation · Apache Airflow MSSQL Provider Apache Software Foundation · Apache Airflow ODBC Provider

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/apache/airflow/pull/31984 https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj