====================================================================

                                CERT-Renater

                     Note d'Information No. 2023/VULN241

_____________________________________________________________________

DATE                : 03/07/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Airflow ODBC Provider
                              versions prior to 4.0.0,
               Apache Airflow MSSQL Provider versions prior to 3.4.1,
                Apache Airflow ODBC Provider versions prior to 4.0.0.

====================================================================
https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj
https://lists.apache.org/thread/ynbjwp4n0vzql0xzhog1gkp1ovncf8j3
https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd
_____________________________________________________________________

CVE-2023-35798: Airflow Apache ODBC and MSSQL Providers Arbitrary
File Read Vulnerability
Severity: low

Affected versions:

- Apache Airflow ODBC Provider before 4.0.0
- Apache Airflow MSSQL Provider before 3.4.1

Description:

Input Validation vulnerability in Apache Software Foundation Apache
Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL
Provider.This vulnerability is considered low since it requires DAG
code to use `get_sqlalchemy_connection` and someone with access to
connection resources specifically updating the connection to exploit
it.

This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache
Airflow MSSQL Provider: before 3.4.1.

It is recommended to upgrade to a version that is not affected


Credit:

id_No2015429 of 3H Secruity Team (finder)


References:

https://github.com/apache/airflow/pull/31984
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-35798

_____________________________________________________________________

CVE-2023-22886: Apache Airflow JDBC Provider: RCE Vulnerability
Severity: low

Affected versions:

- Apache Airflow JDBC Provider before 4.0.0

Description:

Improper Input Validation vulnerability in Apache Software Foundation
Apache Airflow JDBC Provider.

Airflow JDBC Provider Connection’s [Connection URL] parameters had no
restrictions, which made it possible to implement RCE attacks via
different type JDBC drivers, obtain airflow server permission.
This issue affects Apache Airflow JDBC Provider: before 4.0.0.

Credit:

heart Y (finder)
happyhacking (finder)

References:

https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-22886

_____________________________________________________________________

CVE-2023-34395: Apache Airflow ODBC Provider: Remote code execution
vulnerability

Severity: moderate

Affected versions:

- Apache Airflow ODBC Provider before 4.0.0


Description:

Improper Neutralization of Argument Delimiters in a Command
('Argument Injection') vulnerability in Apache Software
Foundation Apache Airflow ODBC Provider.

In OdbcHook, A privilege escalation vulnerability exists in a
system due to controllable ODBC driver parameters that allow
the loading of arbitrary dynamic-link libraries, resulting in
command execution.

Starting version 4.0.0 driver can be set only from the hook
constructor.

This issue affects Apache Airflow ODBC Provider: before 4.0.0.

Credit:

KmhlYXJ0 (finder)

References:

https://github.com/apache/airflow/pull/31713
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-34395


========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
========================================================