~ / search / GHSA-mm87-c3x2-6f89

GHSA-mm87-c3x2-6f89

Apache Airflow JDBC Provider Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-22886

Packages

EcosystemPackageAffectedFixed in
PyPI apache-airflow-providers-jdbc < 4.0.0 4.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow JDBC Provider. Airflow JDBC Provider Connection’s [Connection URL] parameters had no restrictions, which made it possible to implement RCE attacks via different type JDBC drivers, obtain airflow server permission. This issue affects Apache Airflow JDBC Provider: before 4.0.0.

References

External links from the advisory. They lead to third-party sites.