CVE-2023-33234

Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
References
Link Resource
https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq Mailing List Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow_cncf_kubernetes:*:*:*:*:*:*:*:*

History

05 Jun 2023, 16:45

Type Values Removed Values Added
References (MISC) https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq - (MISC) https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq - Mailing List, Vendor Advisory
CVSS v2 : unknown
v3 : unknown
v2 : unknown
v3 : 7.2
CPE cpe:2.3:a:apache:airflow_cncf_kubernetes:*:*:*:*:*:*:*:*
First Time Apache
Apache airflow Cncf Kubernetes

30 May 2023, 11:15

Type Values Removed Values Added
New CVE

Information

Published : 2023-05-30 11:15

Updated : 2024-10-10 15:35


NVD link : CVE-2023-33234

Mitre link : CVE-2023-33234

CVE.ORG link : CVE-2023-33234


JSON object : View

Products Affected

apache

  • airflow_cncf_kubernetes
CWE
CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')