Apache Airflow up to 2.6.0 CNCF Kubernetes Provider log file

Summaryinfo

A vulnerability identified as problematic has been detected in Apache Airflow up to 2.6.0. This impacts an unknown function of the component CNCF Kubernetes Provider. This manipulation causes log file. This vulnerability appears as CVE-2023-51702. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Apache Airflow up to 2.6.0. It has been declared as problematic. Affected by this vulnerability is some unknown functionality of the component CNCF Kubernetes Provider. The manipulation with an unknown input leads to a log file vulnerability. The CWE definition for the vulnerability is CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. As an impact it is known to affect confidentiality. The summary by CVE is:

Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.

The weakness was presented 01/24/2024 by Hussein Awala. The advisory is shared at github.com. This vulnerability is known as CVE-2023-51702 since 12/21/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 2.6.1 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Business Process Management Software

Vendor

• Apache

Name

• Airflow

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6.0

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/airflow/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion