GHSA-x5pm-h33q-cjrw

Improper Certificate Validation in apache airflow mongo hook

Source: GitHub Advisory Database (reviewed) Critical CVE-2024-25141

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow-providers-mongo	< 4.0.0	4.0.0

Details

As written in the advisory (Markdown source, shown as plain text).

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-25141 advisory
https://github.com/apache/airflow/pull/37214 web
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-mongo/PYSEC-2026-278.yaml web
https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm web
https://pypi.org/project/apache-airflow-providers-mongo web
http://www.openwall.com/lists/oss-security/2024/02/20/5 web