In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache Airflow CNCF Kubernetes Provider | unaffected |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-1930 | Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability. |
 Github GHSA |
GHSA-2rx4-9f5h-9gjf | Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration |
Thu, 10 Oct 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: apache
Published:
Updated: 2024-10-10T14:29:26.536Z
Reserved: 2023-05-18T19:15:07.833Z
Link: CVE-2023-33234
Vulnrichment
Updated: 2024-08-02T15:39:35.691Z
NVD
Status : Modified
Published: 2023-05-30T11:15:09.553
Modified: 2024-11-21T08:05:12.210
Link: CVE-2023-33234
Redhat
No data.
OpenCVE Enrichment
No data.