CVE-2023-35797: Apache Airflow Hive Provider Beeline RCE with Principal
First published: Mon Jul 03 2023(Updated: )
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Apache-airflow-providers-apache-hive | <6.1.1 | |
| pip/apache-airflow-providers-apache-hive | <6.1.1 | 6.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-35797
- https://github.com/apache/airflow/pull/31983
- https://lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1y
- https://github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268
- http://www.openwall.com/lists/oss-security/2023/07/12/3
- https://github.com/advisories/GHSA-hg6c-qqcm-r79r (Advisory)
Frequently Asked Questions
What is CVE-2023-35797?
CVE-2023-35797 is an Improper Input Validation vulnerability found in Apache Airflow Hive Provider before version 6.1.1.
How does CVE-2023-35797 affect Apache Airflow Hive Provider?
CVE-2023-35797 allows bypassing the security check to achieve Remote Code Execution (RCE) via the principal parameter.
What is the severity of CVE-2023-35797?
The severity of CVE-2023-35797 is critical with a CVSS score of 9.8.
How can CVE-2023-35797 be exploited?
CVE-2023-35797 can be exploited by bypassing the security check and injecting malicious code through the principal parameter.
How can I fix CVE-2023-35797?
To fix CVE-2023-35797, upgrade your Apache Airflow Hive Provider to version 6.1.1 or later.
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-hg6c-qqcm-r79r
- alias/CVE-2023-35797
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/weakness
- agent/remedy
- agent/title
- agent/event
- agent/description
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/apache
- canonical/apache apache-airflow-providers-apache-hive
- package-manager/pip