CVE-2023-37379
Description
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.
How to fix
- apache airflow2.7.0 or later
- apache-airflow2.7.0b1, 2.7.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache airflow | v < 2.7.0 | 2.7.0 |
| apache-airflowPyPI | v < 2.7.0b1, v < 2.7.0 | 2.7.0b1, 2.7.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.