Vulnerability · Published Jul 3, 2023 · Assigned by apache
CVE-2023-35797Apache Airflow Hive Provider Beeline RCE with Principal
Critical 9.8
In plain English
A critical-severity improper input validation in Apache Airflow Apache Hive Provider from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow-providers-apache-hive | 6.1.1 | GHSA-hg6c-qqcm-r79r |
| PyPI | apache-airflow-providers-apache-hive | 6.1.1 | PYSEC-2026-273 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow Apache Hive Provider | 0 – before 6.1.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H