CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE
First published: Fri Aug 25 2023(Updated: )
Deserialization of Untrusted Data, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Software Foundation Apache Airflow Spark Provider. When the Apache Spark provider is installed on an Airflow deployment, an Airflow user that is authorized to configure Spark hooks can effectively run arbitrary code on the Airflow node by pointing it at a malicious Spark server. Prior to version 4.1.3, this was not called out in the documentation explicitly, so it is possible that administrators provided authorizations to configure Spark hooks without taking this into account. We recommend administrators to review their configurations to make sure the authorization to configure Spark hooks is only provided to fully trusted users. To view the warning in the docs please visit https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow Spark Provider | <4.1.3 | |
| pip/apache-airflow-providers-apache-spark | <4.1.3 | 4.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/33233
- https://lists.apache.org/thread/fzy95b1d6zv31j5wrx3znhzcscck2o24
- https://nvd.nist.gov/vuln/detail/CVE-2023-40195
- https://github.com/apache/airflow/commit/6850b5c777fa515e110ad1daa85242209a8ec6c0
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-apache-spark/PYSEC-2023-156.yaml
- https://github.com/advisories/GHSA-8q28-pw9g-w82c (Advisory)
Frequently Asked Questions
What is CVE-2023-40195?
CVE-2023-40195 is a deserialization vulnerability in Apache Airflow Spark Provider that allows for remote code execution (RCE).
How severe is CVE-2023-40195?
CVE-2023-40195 has a severity rating of 8.8 (high).
What software is affected by CVE-2023-40195?
Apache Airflow Spark Provider version up to 4.1.3 is affected by CVE-2023-40195.
How does CVE-2023-40195 work?
CVE-2023-40195 exploits the deserialization of untrusted data in Apache Airflow Spark Provider, allowing an attacker to execute arbitrary code.
Is there a fix for CVE-2023-40195?
Yes, updating to a version of Apache Airflow Spark Provider above 4.1.3 will fix CVE-2023-40195.
- collector/oss-sec
- alias/CVE-2023-40195
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/remedy
- agent/title
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-8q28-pw9g-w82c
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/nvd-cve
- source/NVD
- agent/event
- collector/github-advisory
- agent/softwarecombine
- agent/tags
- agent/trending
- agent/source
- vendor/apache
- canonical/apache airflow spark provider
- package-manager/pip