Vulnerability · Published Aug 28, 2023 · Assigned by apache
CVE-2023-27604Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE Vulnerability
High 8.8
In plain English
A high-severity improper input validation in Apache Airflow Sqoop Provider from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Airflow Sqoop Provider, versions before 4.0.0, is affected by a vulnerability that allows an attacker pass parameters with the connections, which makes it possible to implement RCE attacks via ‘sqoop import --connect’, obtain airflow server permissions, etc. The attacker needs to be logged in and have authorization (permissions) to create/edit connections. It is recommended to upgrade to a version that is not affected. This issue was reported independently by happyhacking-k, And Xie Jianming and LiuHui of Caiji Sec Team also reported it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow-providers-apache-sqoop | 4.0.0 | GHSA-g3m9-pr5m-4cvp |
| PyPI | apache-airflow-providers-apache-sqoop | 4.0.0 | PYSEC-2026-1142 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow Sqoop Provider | 0 – before 4.0.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H