Apache Airflow up to 2.6.x Test Connection resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in Apache Airflow up to 2.6.x. Affected by this issue is some unknown functionality of the component Test Connection Handler. The manipulation results in resource consumption. This vulnerability is identified as CVE-2023-37379. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Airflow up to 2.6.x. It has been classified as problematic. Affected is some unknown functionality of the component Test Connection Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability. CVE summarizes:

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

The weakness was released 08/23/2023. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-37379 since 07/04/2023. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.7.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/airflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion