CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags
First published: Fri Oct 13 2023(Updated: )
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/apache-airflow | >=0<2.7.2 | 2.7.2 |
| <2.7.2 | ||
| Apache Airflow | <2.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2023-42663
- https://github.com/apache/airflow/pull/34315
- https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-197.yaml
- http://www.openwall.com/lists/oss-security/2023/11/12/2
- https://github.com/advisories/GHSA-32wr-qqw6-5mfp (Advisory)
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-42663.
What is the title of this vulnerability?
The title of this vulnerability is 'CVE-2023-42663: Apache Airflow: Bypass permission verification to view task instances of other dags'.
What is the description of this vulnerability?
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
How can I mitigate the risk associated with this vulnerability?
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Where can I find more information about this vulnerability?
More information about this vulnerability can be found at the following references: <ul><li>https://github.com/apache/airflow/pull/34315</li><li>https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9</li><li>https://nvd.nist.gov/vuln/detail/CVE-2023-42663</li></ul>
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-32wr-qqw6-5mfp
- alias/CVE-2023-42663
- collector/github-advisory-latest
- collector/mitre-cve
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- collector/nvd-cve
- collector/nvd-index
- collector/oss-sec
- package-manager/pip
- vendor/apache
- canonical/apache airflow