CVE-2023-27604: Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability
First published: Fri Aug 25 2023(Updated: )
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow Sqoop Provider | <4.0.0 | |
| pip/apache-airflow-providers-apache-sqoop | <4.0.0 | 4.0.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-27604?
CVE-2023-27604 is a vulnerability in Apache Airflow Sqoop Provider that allows an attacker to implement remote code execution attacks.
What is the severity of CVE-2023-27604?
CVE-2023-27604 has a severity rating of 8.8, which is high.
How does CVE-2023-27604 affect Apache Airflow Sqoop Provider?
CVE-2023-27604 affects Apache Airflow Sqoop Provider versions before 4.0.0 by allowing an attacker to pass parameters with connections, leading to potential remote code execution attacks.
How can an attacker exploit CVE-2023-27604?
An attacker can exploit CVE-2023-27604 by using the 'sqoop import --connect' command to pass malicious parameters, potentially gaining unauthorized access and permissions on the Apache Airflow server.
How can I fix CVE-2023-27604?
To fix CVE-2023-27604, it is recommended to update Apache Airflow Sqoop Provider to version 4.0.0 or later.
- collector/oss-sec
- alias/CVE-2023-27604
- collector/github-advisory-latest
- alias/GHSA-g3m9-pr5m-4cvp
- collector/github-advisory
- collector/nvd-index
- agent/references
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/title
- agent/weakness
- agent/description
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/tags
- agent/trending
- package-manager/pip
- vendor/apache
- canonical/apache airflow sqoop provider