GHSA-j3w8-2p2h-mrr9: Apache Airflow vulnerable to privilege escalation

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2023-42792

Apache Airflow vulnerable to privilege escalation

Moderate severity GitHub Reviewed Published Oct 14, 2023 to the GitHub Advisory Database • Updated Oct 17, 2023

Vulnerability details Dependabot alerts 0

Package

pip apache-airflow (pip)

Affected versions

< 2.7.2

Patched versions

2.7.2

Description

Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn’t.

Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-42792
• apache/airflow#34366
• https://lists.apache.org/thread/1spbo9nkn49fc2hnxqm9tf6mgqwp9tjq

Published to the GitHub Advisory Database

Oct 14, 2023

Last updated

Oct 17, 2023

Reviewed

Oct 17, 2023

Severity

Moderate

Weaknesses

CWE-668

CVE ID

CVE-2023-42792

GHSA ID

GHSA-j3w8-2p2h-mrr9

Source code

apache/airflow

Checking history

See something to contribute? Suggest improvements for this vulnerability.