high7.5
CVE-2023-28710
Apache Airflow Spark Provider vulnerable to improper input validation
Impact
Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain `/` and `?` which is used to denote the end of the field.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-airflow-providers-apache-spark | < 4.0.1 | 4.0.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Apache-Airflow-Providers-Apache-Spark | before 4.0.1 |