CVE-2023-35798

27.06.2023, 12:15

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.Thisvulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specificallyupdating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended toupgrade to a version that is not affected

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
apache	CNA	---				---
CVE	ADP	---				---
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 27%

Vendor	Product	Version
apache	apache-airflow-providers-microsoft-mssql	𝑥 < 3.4.1
apache	apache-airflow-providers-odbc	𝑥 < 4.0.0

𝑥

= Vulnerable software versions

Common Weakness Enumeration

CWE-20 - Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://github.com/apache/airflow/pull/31984

https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj

https://github.com/apache/airflow/pull/31984

https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj