GHSA-85pf-r4c7-3j9r

Apache Airflow Drill Provider vulnerable to improper input validation

Source: GitHub Advisory Database (reviewed) High CVE-2023-28707

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow-providers-apache-drill	< 2.3.2	2.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Software Foundation's Apache Airflow Drill Provider before 2.3.2 is vulnerable to improper input validation because the host passed in drill connection is not sanitized.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-28707 advisory
https://github.com/apache/airflow/pull/30215 web
https://github.com/apache/airflow/commit/63d9b24aad0b4b9397682ddac1ea5824354789b3 web
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-3.yaml web
https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk web
https://www.openwall.com/lists/oss-security/2023/04/07/1 web
http://www.openwall.com/lists/oss-security/2023/04/07/1 web