CVE-2023-42781: Apache Airflow: Permission verification bypass allows viewing dagruns of other dags
First published: Sun Nov 12 2023(Updated: )
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow | <2.7.3 | |
| pip/apache-airflow | <2.7.3 | 2.7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/34939
- https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1
- http://www.openwall.com/lists/oss-security/2023/11/12/2
- https://nvd.nist.gov/vuln/detail/CVE-2023-42781
- https://github.com/apache/airflow/commit/33ec72948f74f56f2adb5e2d388e60e88e8a3fa3
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-231.yaml
- https://github.com/advisories/GHSA-r7x6-xfcm-3mxv (Advisory)
Frequently Asked Questions
What is CVE-2023-42781?
CVE-2023-42781 is a vulnerability in Apache Airflow that allows an authorized user to view information about task instances in other DAGs, even if they only have access to read specific DAGs.
What versions of Apache Airflow are affected?
Versions before 2.7.3 of Apache Airflow are affected.
How can an authorized user exploit this vulnerability?
An authorized user with access to read specific DAGs can exploit this vulnerability to view information about task instances in other DAGs.
How can I fix CVE-2023-42781?
To fix CVE-2023-42781, upgrade to Apache Airflow version 2.7.3 or later.
Where can I find more information about CVE-2023-42781?
You can find more information about CVE-2023-42781 in the references provided: [Github Pull Request](https://github.com/apache/airflow/pull/34939), [Apache Mailing List](https://lists.apache.org/thread/7dnl8nszdxqyns57f3dw0sloy5dfl9o1), [Openwall](http://www.openwall.com/lists/oss-security/2023/11/12/2).
- collector/oss-sec
- alias/CVE-2023-42781
- collector/mitre-cve
- collector/nvd-api
- collector/github-advisory-latest
- alias/GHSA-r7x6-xfcm-3mxv
- collector/nvd-cve
- collector/github-advisory
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/title
- agent/tags
- agent/type
- agent/event
- agent/description
- agent/remedy
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- vendor/apache
- canonical/apache airflow
- package-manager/pip