Vulnerability Description
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Apache | Airflow | < 2.7.2 |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing ListThird Party Advisory
- https://github.com/apache/airflow/pull/34315Patch
- https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9Mailing ListVendor Advisory
- http://www.openwall.com/lists/oss-security/2023/11/12/2Mailing ListThird Party Advisory
- https://github.com/apache/airflow/pull/34315Patch
- https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9Mailing ListVendor Advisory
FAQ
What is CVE-2023-42663?
CVE-2023-42663 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Ap...
How severe is CVE-2023-42663?
CVE-2023-42663 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-42663?
Check the references section above for vendor advisories and patch information. Affected products include: Apache Airflow.