GitHub Advisoryadvisory · PyPI

GHSA-q57w-826p-46jr Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

MEDIUM Published 2023-06-27 Modified 2023-07-06 Official page ↗
Aliases
CVE-2023-35798
Ecosystem
PyPI
Packages
apache-airflow-providers-odbc, apache-airflow-providers-microsoft-mssql
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-20
Reviewed
2023-06-30

Affected packages

• PyPI apache-airflow-providers-odbc: < 4.0.0 → fixed in 4.0.0 • PyPI apache-airflow-providers-microsoft-mssql: < 3.4.1 → fixed in 3.4.1

Description

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not affected

Related

Alias · CVE (1)

  • CVE-2023-35798 Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References