Apache Software Foundation Apache Airflow Cncf Kubernetes Provider vulnerabilities
2 known vulnerabilities affecting apache_software_foundation/apache_airflow_cncf_kubernetes_provider.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2023-51702MEDIUMCVSS 6.5≥ 5.2.0, < 7.0.02024-01-24
CVE-2023-51702 [MEDIUM] CWE-312 CVE-2023-51702: Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configura
cvelistv5nvd
CVE-2023-33234HIGHCVSS 7.2≥ 5.0.0, ≤ 6.1.02023-05-30
CVE-2023-33234 [HIGH] CWE-74 CVE-2023-33234: Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to cha
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0
cvelistv5nvd