CVE-2023-33234
published 2023-05-30CVE-2023-33234: Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow…
PriorityP346high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
1.53%
71.9th percentile
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | apache-airflow-providers-cncf-kubernetes | >= 5.0.0 < 7.0.0 | 7.0.0 |
| apache_software_foundation | apache_airflow_cncf_kubernetes_provider | 5.0.0 – 6.1.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
ghsa·2023-07-06
CVE-2023-33234 [HIGH] CWE-74 Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
OSV
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
osv·2023-07-06
CVE-2023-33234 [HIGH] Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configuration
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-05-30
Published