CVE-2023-41267

Katalog CVE

CVSS 7.8 · High EPSS 0,61%

Kerentanan Inclusion of Functionality from Untrusted Control Sphere pada apache airflow hdfs provider. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

Rincian

Terbit di NVD

14 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,61% peluang dieksploitasi; lebih tinggi dari 47,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z mailing list · advisory vendor
• https://github.com/apache/airflow/pull/33813 patch
• http://www.openwall.com/lists/oss-security/2023/09/14/3 mailing list · advisory pihak ketiga