Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2023-25696: Validate Hive Beeline parameters by potiuk · Pull Request #29502 · apache/airflow

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.

CVE
#vulnerability#apache

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am now of an opinion that constructors in our operators should just assign fields. Full stop.

Yes, same. I guess I figured since this was a hook, we’re not moving the connection call out, and it’s currently not going to get called in an operator, why not push up the validation? But I see it was misguided suggestion.

…get rid of explicit constructor and turn all our operators in ‘dataclasses’

I would be over the moon if this was the implementation or attrs; the latter has been life changing. It’s a shame you can’t build an operator now, with any real added value in simplication, with attrs because of the metaclass logic going on. Alas, I would love this.

Related news

GHSA-9mwf-mw74-9cv5: Apache Airflow Hive Provider Improper Input Validation vulnerability

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907