GitHub Advisoryadvisory · PyPI
GHSA-hm9r-7f84-25c9 Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes
MEDIUM
Official page ↗
- Aliases
- CVE-2023-47037
- Ecosystem
- PyPI
- Packages
- apache-airflow
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weaknesses
- CWE-285, CWE-863
- Reviewed
- 2023-11-13
Affected packages
• PyPI apache-airflow: < 2.7.3 → fixed in 2.7.3
Description
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
Related
Alias · CVE (1)
- CVE-2023-47037 We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-47037 advisory
- https://github.com/apache/airflow/pull/33413 web
- https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad web
- https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef web
- https://github.com/apache/airflow package
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml web
- https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0 web
- http://www.openwall.com/lists/oss-security/2023/11/12/1 web