critical9.8
CVE-2023-28706
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Ai…
Impact
Apache Software Foundation's Apache Airflow Hive Provider before 6.0.0 is vulnerable to improper control of generation of code.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-airflow-providers-apache-hive | < 6.0.0 | 6.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Airflow Hive Provider | before 6.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-5cvg-9pp5-mxcj
- https://nvd.nist.gov/vuln/detail/CVE-2023-28706
- https://github.com/apache/airflow/pull/30212
- https://lists.apache.org/thread/dl20xxd51xvlx0zzc0wzgxfjwgtbbxo3
- http://www.openwall.com/lists/oss-security/2023/04/07/2
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow-providers-apache-hive/PYSEC-2026-271.yaml
- https://pypi.org/project/apache-airflow-providers-apache-hive