[<prev] [next>] [day] [month] [year] [list]
Message-ID: <257d8e51-81ab-861d-f87b-3ce1b82d0883@apache.org>
Date: Fri, 07 Apr 2023 13:59:45 +0000
From: Jarek Potiuk <potiuk@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-28706: Apache Airflow Hive Provider Beeline Remote
Command Execution
Severity: low
Description:
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 6.0.0.
Credit:
sw0rd1ight of Caiji Sec Team and 4ra1n of Chaitin Tech (finder)
References:
https://github.com/apache/airflow/pull/30212
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2023-28706
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
