Headline
GHSA-9766-v29c-4vm7: Apache Airflow ODBC Provider Argument Injection vulnerability
Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2023-34395
Apache Airflow ODBC Provider Argument Injection vulnerability
Moderate severity GitHub Reviewed Published Jun 27, 2023 to the GitHub Advisory Database • Updated Jun 30, 2023
Package
pip apache-airflow-providers-odbc (pip)
Affected versions
< 4.0.0
Published to the GitHub Advisory Database
Jun 27, 2023
Last updated
Jun 30, 2023
Related news
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.