The vulnerabilities of the Airflow SMTP Provider and Airflow IMAP Provider software, which are used for creating, monitoring, and orchestrating data processing scenarios in Airflow, allow attackers to gain unauthorized access to confidential data.

🗓️ 30 Aug 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

Airflow mail and internet messaging providers have certificate validation flaws enabling data access.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-39441	23 Aug 202320:12	–	circl
CNNVD	Apache Airflow 信任管理问题漏洞	23 Aug 202300:00	–	cnnvd
CNVD	Apache Airflow Trust Management Issues Vulnerability	25 Aug 202300:00	–	cnvd
CVE	CVE-2023-39441	23 Aug 202315:39	–	cve
Cvelist	CVE-2023-39441 Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation	23 Aug 202315:39	–	cvelist
EUVD	EUVD-2023-2213	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Airflow missing Certificate Validation	23 Aug 202318:30	–	github
NVD	CVE-2023-39441	23 Aug 202316:15	–	nvd
OSV	BIT-AIRFLOW-2023-39441 Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation	6 Mar 202410:53	–	osv
OSV	GHSA-5F35-PQ34-C87Q Apache Airflow missing Certificate Validation	23 Aug 202318:30	–	osv

Vulners

Node

apache airflow_smtp_providerRange<1.30

OR

apache airflow_imap_providerRange<3.3.0

OR

apache airflowRange<2.7.0

Source	Link
lists	www.lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb
vuldb	www.vuldb.com/ru/
github	www.github.com/advisories/GHSA-5f35-pq34-c87q
web	www.web.nvd.nist.gov/view/vuln/detail

30 Aug 2023 00:00Current

6.2Medium risk

Vulners AI Score6.2

CVSS 25.4

CVSS 35.9

EPSS0.00594

airflow mail provider internet messaging provider certificate validation flaw data access unauthorized access