CVE-2023-36543: Apache Airflow: ReDoS via dags function
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-airflowto a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
Apache Airflowto a version that resolves this vulnerability.Fixed in 2.6.3
Event History
Frequently Asked Questions
What is CVE-2023-36543?
CVE-2023-36543 is a vulnerability in Apache Airflow versions before 2.6.3 where an authenticated user can use crafted input to make the current request hang.
What is the severity of CVE-2023-36543?
The severity of CVE-2023-36543 is medium with a CVSS v3 score of 6.5 out of 10.
How can I fix CVE-2023-36543?
To fix CVE-2023-36543, it is recommended to upgrade to Apache Airflow version 2.6.3 or above.
Where can I find more information about CVE-2023-36543?
You can find more information about CVE-2023-36543 on the Apache Airflow GitHub page, the Apache mailing list, and the NIST NVD website.
What are the Common Weakness Enumerations (CWEs) associated with CVE-2023-36543?
The Common Weakness Enumerations (CWEs) associated with CVE-2023-36543 are CWE-1333 (Improper Handling of Highly Compressed Data) and CWE-20 (Improper Input Validation).