GitHub Advisoryadvisory · PyPI

GHSA-g3m9-pr5m-4cvp Airflow Sqoop Provider RCE Vulnerability

HIGH Published 2023-08-28 Modified 2023-09-01 Official page ↗
Aliases
CVE-2023-27604
Ecosystem
PyPI
Packages
apache-airflow-providers-apache-sqoop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-08-30

Affected packages

• PyPI apache-airflow-providers-apache-sqoop: < 4.0.0 → fixed in 4.0.0

Description

Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.

Related

Alias · CVE (1)

  • CVE-2023-27604 Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References