CVE-2023-40272: Apache Airflow Spark Provider Improper Input Validation vulnerability

August 17, 2023 (updated February 13, 2025)

Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade to a version that is not affected.

References

github.com/advisories/GHSA-r2f6-6928-fh8f
lists.apache.org/thread/t03gktyzyor20rh06okd91jtqmw6k1l7
nvd.nist.gov/vuln/detail/CVE-2023-40272

Code Behaviors & Features

Detect and mitigate CVE-2023-40272 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →