CVE-2023-47037: Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)
First published: Sun Nov 12 2023(Updated: )
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow | <2.7.3 | |
| pip/apache-airflow | <2.7.3 | 2.7.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/33413
- https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
- http://www.openwall.com/lists/oss-security/2023/11/12/1
- https://nvd.nist.gov/vuln/detail/CVE-2023-47037
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml
- https://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
- https://github.com/advisories/GHSA-hm9r-7f84-25c9 (Advisory)
- https://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
Frequently Asked Questions
What is CVE-2023-47037?
CVE-2023-47037 is a vulnerability in Apache Airflow that allows authenticated users to modify some DAG run detail values when submitting notes.
How does CVE-2023-47037 affect Apache Airflow?
CVE-2023-47037 affects Apache Airflow versions before 2.7.3, allowing authenticated users to modify certain DAG run detail values.
What is the severity of CVE-2023-47037?
CVE-2023-47037 is considered a medium severity vulnerability with a CVSS score of 4.3.
How can I fix CVE-2023-47037 in Apache Airflow?
To fix CVE-2023-47037, upgrade to Apache Airflow version 2.7.3 or later.
Where can I find more information about CVE-2023-47037?
You can find more information about CVE-2023-47037 at the following references: [Openwall](http://www.openwall.com/lists/oss-security/2023/11/12/1), [GitHub](https://github.com/apache/airflow/pull/33413), [Apache Mailing List](https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0).
- collector/oss-sec
- alias/CVE-2023-47037
- alias/CVE-2023-40611
- collector/mitre-cve
- collector/nvd-api
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hm9r-7f84-25c9
- agent/software-canonical-lookup
- agent/remedy
- agent/title
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/event
- agent/description
- collector/nvd-cve
- source/NVD
- agent/tags
- collector/github-advisory
- vendor/apache
- canonical/apache airflow
- package-manager/pip