high7.5
CVE-2023-28707
Apache Airflow Drill Provider vulnerable to improper input validation
Impact
Apache Software Foundation's Apache Airflow Drill Provider before 2.3.2 is vulnerable to improper input validation because the host passed in drill connection is not sanitized.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-airflow-providers-apache-drill | < 2.3.2 | 2.3.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Apache-Airflow-Providers-Apache-Drill | before 2.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://www.openwall.com/lists/oss-security/2023/04/07/1
- https://github.com/apache/airflow/pull/30215
- https://lists.apache.org/thread/dfoj7q1nd0vhhsl8fjg63z4j6mfmdxtk
- https://github.com/advisories/GHSA-85pf-r4c7-3j9r
- https://nvd.nist.gov/vuln/detail/CVE-2023-28707
- https://github.com/apache/airflow/commit/63d9b24aad0b4b9397682ddac1ea5824354789b3
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-3.yaml
- https://www.openwall.com/lists/oss-security/2023/04/07/1