CVE-2024-25141criticalCWE-295

CVE-2024-25141: falha crítica em Apache Airflow Mongo Provider

Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Apache Airflow Mongo Provider+ Monitorar apache-airflow-providers-mongo

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 0.6%
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
Apache Software Foundation · Apache Airflow Mongo Provider