CVE-2023-41267

🗓️ 14 Sep 2023 07:46:42Reported by apacheType

Apache Airflow HDFS Provider allows for execution of code via an incorrect pip package (CVE-2023-41267)

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2023-41267	14 Sep 202312:24	–	circl
CNNVD	Apache Airflow 安全漏洞	14 Sep 202300:00	–	cnnvd
CNVD	SiYuan Notes Software Web App is a privacy-first personal knowledge management system that supports full offline use as well as end-to-end encrypted synchronization. Yunnan ChainDrop Technology Co., Ltd. has an XSS vulnerability in the Siyuan Notes Software Web application, which can be exploited by attackers to obtain sensitive information such as user cookies.	18 Sep 202300:00	–	cnvd
Cvelist	CVE-2023-41267 Apache HDFS Provider error message suggested installation of incorrect pip package	14 Sep 202307:46	–	cvelist
EUVD	EUVD-2023-2432	3 Oct 202520:07	–	euvd
Tenable Nessus	Fedora 40 : golang-cloud-google / golang-cloud-google-bigquery / etc (2023-f23d9c5057)	29 Apr 202400:00	–	nessus
Github Security Blog	Apache HDFS Provider error message suggested	14 Sep 202309:30	–	github
NVD	CVE-2023-41267	14 Sep 202308:15	–	nvd
OSV	GHSA-5HJ9-M76G-XRC8 Apache HDFS Provider error message suggested	14 Sep 202309:30	–	osv
Prion	Code injection	14 Sep 202308:15	–	prion

NVD

Vulners

Vulnrichment

Node

apache airflow_hdfs_providerRange<4.1.1

[
  {
    "collectionURL": "https://pypi.python.org/",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow-providers-apache-hdfs",
    "product": "Apache Airflow HDFS Provider",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "4.1.1",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/apache/airflow/pull/33813
lists	www.lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z
openwall	www.openwall.com/lists/oss-security/2023/09/14/3

13 Feb 2025 17:17Current

7.5High risk

Vulners AI Score7.5

CVSS 3.17.8

EPSS0.00492

SSVC

CWE-829