Not rated
CVE-2023-40272 Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass…
Description
Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Airflow Spark Provider 4.1 | earliest → < 4.1.3 | 4.1.3 |
| apache-airflow-providers-apache-drill 4.1 | earliest → < 4.1.3 | 4.1.3 |
References
- lists.apache.org lists.apache.org
- www.openwall.com www.openwall.com
- www.openwall.com www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache Airflow Spark Provider
The 4 CVEs of Apache Airflow Spark Provider →
CVE-2023-40195
Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache…
Not rated
CVE-2023-28710
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects…
Not rated
CVE-2022-40954
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache…
Not rated