CVE-2023-39553: apache-airflow-providers-apache-drill Improper Input Validation vulnerability
(updated )
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.
Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider before 2.4.3. It is recommended to upgrade to a version that is not affected.
References
- github.com/advisories/GHSA-mq4v-6vg4-796c
- github.com/apache/airflow
- github.com/apache/airflow/commit/394a727ac2c18d58978bf186a7a92923460ec110
- github.com/apache/airflow/pull/33074
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-136.yaml
- lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf
- nvd.nist.gov/vuln/detail/CVE-2023-39553
- www.openwall.com/lists/oss-security/2023/08/11/1
Code Behaviors & Features
Detect and mitigate CVE-2023-39553 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →