CVE-2023-39441

Katalog CVE

CVSS 5.9 · Medium EPSS 0,80%

Kerentanan Improper Certificate Validation pada apache airflow, apache-airflow-providers-imap +1 lainnya. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability

Rincian

Terbit di NVD

23 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb mailing list · patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2023/08/23/2 mailing list · patch · advisory pihak ketiga
• https://github.com/apache/airflow/pull/33070 patch
• https://github.com/apache/airflow/pull/33075 patch
• https://github.com/apache/airflow/pull/33108 patch