CVE-2023-35798

Airflow Apache ODBC and MSSQL Providers Arbitrary File Read Vulnerability

State: Published
Severity: Not scored
Published: Jun 27, 2023
Updated: Oct 7, 2024
Reserved: Jun 17, 2023

Description

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected

Scores

The record has no CVSS score.

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
Apache Airflow ODBC ProviderApache Software Foundation	before 4.0.0Affected
Apache Airflow MSSQL ProviderApache Software Foundation	before 3.4.1Affected

References

https://github.com/apache/airflow/pull/31984patch
https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pjvendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.