CVE-2023-41267: Apache HDFS Provider error message suggested installation of incorrect pip package
First published: Thu Sep 14 2023(Updated: )
In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow HDFS Provider | <4.1.1 | |
| pip/apache-airflow-providers-apache-hdfs | <4.1.1 | 4.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-41267?
CVE-2023-41267 is a vulnerability in the Apache Airflow HDFS Provider that suggested the installation of an incorrect pip package, potentially allowing an attacker to execute malicious code.
What is the severity of CVE-2023-41267?
The severity of CVE-2023-41267 is high, with a CVSS score of 7.8.
How does CVE-2023-41267 impact Apache Airflow HDFS Provider?
CVE-2023-41267 impacts Apache Airflow HDFS Provider by providing incorrect installation guidance that may lead to the execution of malicious code.
Which versions of Apache Airflow HDFS Provider are affected by CVE-2023-41267?
Versions prior to 4.1.1 of Apache Airflow HDFS Provider are affected by CVE-2023-41267.
How can I fix CVE-2023-41267?
To fix CVE-2023-41267, users should upgrade to Apache Airflow HDFS Provider version 4.1.1 or later.
- collector/oss-sec
- alias/CVE-2023-41267
- collector/nvd-api
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-5hj9-m76g-xrc8
- agent/software-canonical-lookup
- agent/weakness
- agent/remedy
- agent/title
- agent/references
- agent/severity
- agent/softwarecombine
- agent/description
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/trending
- vendor/apache
- canonical/apache airflow hdfs provider
- package-manager/pip