CVE-2023-47037

MEDIUM4.3EPSS 0.08%

Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)

發布日:2023/11/12修改日:2025/5/20

也稱為:GHSA-hm9r-7f84-25c9BIT-airflow-2023-47037PYSEC-2023-232

描述

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.7.3
PyPI/apache-airflowfrom 0, < 2.7.3
PyPI/apache-airflowfrom 0, < 2.7.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-47037
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
WEBhttps://github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
WEBhttps://github.com/apache/airflow/pull/33413
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml
WEBhttps://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
WEBhttp://www.openwall.com/lists/oss-security/2023/11/12/1