CVE-2024-29733 Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context

🗓️ 21 Apr 2024 17:21:55Reported by GoogleType

osv🔗 osv.dev👁 28 Views

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. FTP hook lacks complete certificate validation in FTP_TLS connections, potentially exploitable

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the Airflow FTP Provider network software is related to errors in the authentication process, which allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.	3 May 202400:00	–	bdu_fstec
CNNVD	Apache Airflow 信任管理问题漏洞	21 Apr 202400:00	–	cnnvd
CNVD	Apache Airflow FTP Provider Trust Management Issues Vulnerability	24 Apr 202400:00	–	cnvd
CVE	CVE-2024-29733	21 Apr 202417:21	–	cve
Cvelist	CVE-2024-29733 Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context	21 Apr 202417:21	–	cvelist
EUVD	EUVD-2024-1081	3 Oct 202520:07	–	euvd
Github Security Blog	Improper Certificate Validation vulnerability in Apache Airflow FTP Provider	21 Apr 202418:30	–	github
NVD	CVE-2024-29733	21 Apr 202418:15	–	nvd
OSV	GHSA-3GG8-MC87-CQ3H Improper Certificate Validation vulnerability in Apache Airflow FTP Provider	21 Apr 202418:30	–	osv
OSV	PYSEC-2026-1148 Improper Certificate Validation vulnerability in Apache Airflow FTP Provider	7 Jul 202611:45	–	osv

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/04/19/3
pypi	www.pypi.python.org/
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29733.json
lists	www.lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-29733
github	www.github.com/apache/airflow/pull/38266
docs	www.docs.python.org/3/library/ssl.html
github	www.github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py

08 Jul 2026 06:34Current

6Medium risk

Vulners AI Score6

CVSS 3.12.7

EPSS0.00626