GitHub Advisoryadvisory · PyPI

GHSA-2rx4-9f5h-9gjf Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration

HIGH Published 2023-07-06 Modified 2023-07-06 Official page ↗
Aliases
CVE-2023-33234
Ecosystem
PyPI
Packages
apache-airflow-providers-cncf-kubernetes
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2023-07-06

Affected packages

• PyPI apache-airflow-providers-cncf-kubernetes: >= 5.0.0, < 7.0.0 → fixed in 7.0.0

Description

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.

Related

Alias · CVE (1)

  • CVE-2023-33234 Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References