CVE-2023-33234
30.05.2023, 11:15
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
| Vendor | Product | Version |
|---|---|---|
| apache | airflow_cncf_kubernetes | 5.0.0 ≤ 𝑥 < 7.0.0 |
𝑥
= Vulnerable software versions