CVE-2024-25141

EUVD-2024-0760
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented.
Users are recommended to upgrade to version 4.0.0, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
apacheapache-airflow-providers-mongo
1.0.0 ≤
𝑥
< 4.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2024/02/20/5
https://github.com/apache/airflow/pull/37214
https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm
http://www.openwall.com/lists/oss-security/2024/02/20/5
https://github.com/apache/airflow/pull/37214
https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm