CVE-2023-33234
High
Description
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Apache-airflow-providers-cncf-kubernetes
PublishedMay 30, 2023
First seenMay 30, 2023
Weakness typeCWE-74Injection
How to fix
Update
- apache apache-airflow-providers-cncf-kubernetes7.0.0 or later
- apache-airflow-providers-cncf-kubernetes7.0.0 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache apache-airflow-providers-cncf-kubernetes | 5.0.0 ≤ v < 7.0.0 | 7.0.0 |
| apache-airflow-providers-cncf-kubernetesPyPI | 5.0.0 ≤ v < 7.0.0 | 7.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.