CVE-2023-35798
Assigner: apache
Published: 2023-06-27T11:39:51.759Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: Apache Airflow ODBC Provider
vendor: Apache Software Foundation
versions: lessThan: 4.0.0
status: affected
version: 0
versionType: semver
defaultStatus: unaffected
product: Apache Airflow MSSQL Provider
vendor: Apache Software Foundation
versions: lessThan: 3.4.1
status: affected
version: 0
versionType: semver
credits: type: finder
value: id_No2015429 of 3H Secruity Team
descriptions: supportingMedia: base64: no
type: text/html
value: Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.<p>This&nbsp;vulnerability is considered low since it requires DAG code to use `<span style="background-color: rgb(255, 255, 255);">get_sqlalchemy_connection` and someone with access to connection resources specifically&nbsp;updating the connection to <span style="background-color: rgb(255, 255, 255);">exploit it.</span><br></span><br>This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.<br><br>It is recommended to&nbsp;<span style="background-color: rgb(255, 255, 255);">upgrade to a version that is not affected</span></p>
value: Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected


metrics: other: content: text: low
type: Textual description of severity
problemTypes: descriptions: cweId: CWE-20
description: CWE-20: Improper Input Validation
type: CWE
source: discovery: UNKNOWN
title: Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability
x_generator: engine: Vulnogram 0.1.0-dev