Apache Airflow OpenSSL Certificate certificate validation

Summaryinfo

A vulnerability described as critical has been identified in Apache Airflow, Airflow SMTP Provider and Airflow IMAP Provider. This affects an unknown function of the component OpenSSL Certificate Handler. Such manipulation leads to certificate validation. This vulnerability is uniquely identified as CVE-2023-39441. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in Apache Airflow, Airflow SMTP Provider and Airflow IMAP Provider (unknown version). Affected by this issue is an unknown code block of the component OpenSSL Certificate Handler. The manipulation with an unknown input leads to a certificate validation vulnerability. Using CWE to declare the problem leads to CWE-295. The product does not validate, or incorrectly validates, a certificate. Impacted is integrity. CVE summarizes:

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability

The weakness was disclosed 08/23/2023. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-39441 since 08/02/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1587.003.

Upgrading eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow
• Airflow IMAP Provider
• Airflow SMTP Provider

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/airflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion