CVE-2023-35798CWE-20

CVE-2023-35798: falha em Apache Airflow ODBC Provider

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Airflow ODBC Provider+ Monitorar Apache Airflow MSSQL Provider

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

3Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackepss 1.3%
Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not affected
Produtos afetados
Apache Software Foundation · Apache Airflow MSSQL ProviderApache Software Foundation · Apache Airflow ODBC Provider
CVEs relacionadas — Apache Airflow ODBC Provider

No mesmo produto, das mais perigosas para as menos.

CVE-2023-34395HIGHApache Airflow ODBC Provider: Remote code execution vulnerabilityEPSS 0.8%