GitHub Advisoryadvisory · PyPI

GHSA-ffj9-4crc-q7wf Apache Airflow Spark Provider vulnerable to improper input validation

HIGH Published 2023-04-07 Modified 2023-04-14 Official page ↗
Aliases
CVE-2023-28710
Ecosystem
PyPI
Packages
apache-airflow-providers-apache-spark
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-20
Reviewed
2023-04-07

Affected packages

• PyPI apache-airflow-providers-apache-spark: < 4.0.1 → fixed in 4.0.1

Description

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain `/` and `?` which is used to denote the end of the field.

Related

Alias · CVE (1)

  • CVE-2023-28710 Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References