[<prev] [next>] [day] [month] [year] [list]
Message-ID: <7f536d61-f0f8-145d-3d4d-aa3930190181@apache.org>
Date: Tue, 24 Jun 2025 05:41:04 +0000
From: Elad Kalif <eladkal@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-50213: Apache Airflow Providers Snowflake: Potential SQL
injection in CopyFromExternalStageToSnowflakeOperator
Severity: low
Affected versions:
- Apache Airflow Providers Snowflake (apache-airflow-providers-snowflake) before 6.4.0
Description:
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) vulnerability in Apache Airflow Providers Snowflake.
This issue affects Apache Airflow Providers Snowflake: before 6.4.0.
Sanitation of table and stage parameters were added in CopyFromExternalStageToSnowflakeOperator to prevent SQL injection
Users are recommended to upgrade to version 6.4.0, which fixes the issue.
Credit:
Nhien Pham (@nhienit) at Galaxy One (finder)
References:
https://github.com/apache/airflow/pull/51734
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-50213
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
