CVE-2023-51702

{"id": "CVE-2023-51702", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-01-24T13:15:08.150", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/01/24/3", "tags": ["Mailing List", "Third Party Advisory"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/29498", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/30110", "tags": ["Patch"], "source": "security@apache.org"}, {"url": "https://github.com/apache/airflow/pull/36492", "tags": ["Issue Tracking", "Patch"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.\n\nThis behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue."}, {"lang": "es", "value": "Desde la versi\u00f3n 5.2.0, cuando se utiliza el modo diferible con la ruta de un archivo de configuraci\u00f3n de Kubernetes para la autenticaci\u00f3n, el trabajador de Airflow serializa este archivo de configuraci\u00f3n como un diccionario y lo env\u00eda al activador almacen\u00e1ndolo en metadatos sin ning\u00fan cifrado. Adem\u00e1s, si se utiliza con una versi\u00f3n de Airflow entre 2.3.0 y 2.6.0, el diccionario de configuraci\u00f3n se registrar\u00e1 como texto plano en el servicio activador sin enmascaramiento. Esto permite que cualquier persona con acceso a los metadatos o al registro del activador obtenga el archivo de configuraci\u00f3n y lo utilice para acceder al cl\u00faster de Kubernetes. Este comportamiento se cambi\u00f3 en la versi\u00f3n 7.0.0, que dej\u00f3 de serializar el contenido del archivo y comenz\u00f3 a proporcionar la ruta del archivo para leer el contenido en el activador. Se recomienda a los usuarios actualizar a la versi\u00f3n 7.0.0, que soluciona este problema."}], "lastModified": "2024-01-30T23:00:53.027", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6592EF36-124C-4817-AAA7-33E0D5C1AB57", "versionEndExcluding": "2.6.1", "versionStartIncluding": "2.3.0"}, {"criteria": "cpe:2.3:a:apache:airflow_cncf_kubernetes:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD1C8DDC-BBE7-494E-87EF-F478DB8453C0", "versionEndExcluding": "7.0.0", "versionStartIncluding": "5.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}