CVE-2023-40611: Apache Airflow Dag Runs Broken Access Control Vulnerability
First published: Tue Sep 12 2023(Updated: )
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/apache-airflow | >=0<2.7.1 | 2.7.1 |
| Apache Airflow | <2.7.3 | |
| Apache Airflow | <2.7.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/33413
- https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0
- http://www.openwall.com/lists/oss-security/2023/11/12/1
- https://nvd.nist.gov/vuln/detail/CVE-2023-40611
- https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-170.yaml
- https://github.com/advisories/GHSA-wpg8-mf6h-gm92 (Advisory)
- https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
Frequently Asked Questions
What is CVE-2023-40611?
CVE-2023-40611 is a vulnerability known as Apache Airflow Dag Runs Broken Access Control Vulnerability.
What is the severity of CVE-2023-40611?
The severity of CVE-2023-40611 is medium with a severity value of 4.3.
How does CVE-2023-40611 affect Apache Airflow?
CVE-2023-40611 allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes in Apache Airflow.
How can I fix CVE-2023-40611?
To fix CVE-2023-40611, users should upgrade to version 2.7.1 of Apache Airflow.
Where can I find more information about CVE-2023-40611?
More information about CVE-2023-40611 can be found in the following references: [GitHub Pull Request](https://github.com/apache/airflow/pull/33413), [Apache Mailing List](https://lists.apache.org/thread/8y9xk1s3j4qr36yzqn8ogbn9fl7pxrn0), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-40611)
- collector/oss-sec
- alias/CVE-2023-40611
- collector/nvd-index
- alias/CVE-2023-47037
- collector/mitre-cve
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/author
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wpg8-mf6h-gm92
- agent/references
- agent/last-modified-date
- agent/description
- collector/nvd-cve
- agent/tags
- collector/github-advisory
- vendor/apache
- canonical/apache airflow
- package-manager/pip