Security
Headlines
HeadlinesLatestCVEs

Headline

GHSA-9766-v29c-4vm7: Apache Airflow ODBC Provider Argument Injection vulnerability

Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.

ghsa
#vulnerability#apache#git
  1. GitHub Advisory Database
  2. GitHub Reviewed
  3. CVE-2023-34395

Apache Airflow ODBC Provider Argument Injection vulnerability

Moderate severity GitHub Reviewed Published Jun 27, 2023 to the GitHub Advisory Database • Updated Jun 30, 2023

Package

pip apache-airflow-providers-odbc (pip)

Affected versions

< 4.0.0

Published to the GitHub Advisory Database

Jun 27, 2023

Last updated

Jun 30, 2023

Related news

CVE-2023-34395: Disable setting ODBC driver via extra by default by potiuk · Pull Request #31713 · apache/airflow

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.