Non notée

CVE-2023-33234 Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar…

Description

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Apache Airflow CNCF Kubernetes Provider 5.0	5.0.0 → 6.1.0	Pas de correctif indiqué
airflow_cncf_kubernetes 5.0	5.0.0 → 6.1.0	Pas de correctif indiqué

Références

lists.apache.org lists.apache.org

Chronologie

Publiée 30 mai 2023
Dernière modification 10 octobre 2024

Les 3 CVE de Apache Airflow CNCF Kubernetes Provider →

CVE-2026-27173 JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to… Non notée CVE-2023-51702 Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the… Non notée

Suivre cette CVE