apache/airflow · Security
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
- GHSA ID
- GHSA-2rx4-9f5h-9gjf
- CVE ID
- CVE-2023-33234
- Severity
- high
- Published
- Updated
- CVSS
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 7.2 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
CWEs
- CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')