Riskcovery

CVE-2023-39441

Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation

State
Published
Severity
Not scored
Published
Aug 23, 2023
Updated
Feb 13, 2025
Reserved
Aug 2, 2023

Read the record on cve.org

Description

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.

The default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.

Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability

Scores

The record has no CVSS score.

Weaknesses

  • CWE-295 Improper Certificate Validation

Affected Products

ProductVersions
Apache Airflow SMTP ProviderApache Software Foundation
  • before 1.30Affected
Apache Airflow IMAP ProviderApache Software Foundation
  • before 3.3.0Affected
Apache AirflowApache Software Foundation
  • before 2.7.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.