CVE-2023-33234
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.54%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection. In order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner. Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.54% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-74
- Affected
- apache/apache-airflow-providers-cncf-kubernetes
- Source
- security@apache.org
References
- https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnqMailing List, Vendor Advisory
- https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnqMailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.