GitHub Advisoryadvisory · PyPI
GHSA-85pf-r4c7-3j9r Apache Airflow Drill Provider vulnerable to improper input validation
HIGH
Official page ↗
- Aliases
- CVE-2023-28707
- Ecosystem
- PyPI
- Packages
- apache-airflow-providers-apache-drill
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-20
- Reviewed
- 2023-04-07
Affected packages
• PyPI apache-airflow-providers-apache-drill: < 2.3.2 → fixed in 2.3.2
Description
Apache Software Foundation's Apache Airflow Drill Provider before 2.3.2 is vulnerable to improper input validation because the host passed in drill connection is not sanitized.
Related
Alias · CVE (1)
- CVE-2023-28707 Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill… vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-28707 advisory
- https://github.com/apache/airflow/pull/30215 web
- https://github.com/apache/airflow/commit/63d9b24aad0b4b9397682ddac1ea5824354789b3 web
- https://github.com/apache/airflow package
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-3.yaml web
- https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk web
- https://www.openwall.com/lists/oss-security/2023/04/07/1 web
- http://www.openwall.com/lists/oss-security/2023/04/07/1 web