CVE-2023-41267 Apache HDFS Provider error message suggested installation of incorrect pip package

🗓️ 14 Sep 2023 07:46:42Reported by apacheType

Apache HDFS Provider in Apache Airflow prior to 4.1.1 suggested incorrect pip package installation, now fixe

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the network-based software for automating data processing tasks in HDFS and Apache Airflow’s HDFS Provider lies in the fact that functions from an unverified controlled area are enabled, allowing attackers to load arbitrary packages.	19 Sep 202300:00	–	bdu_fstec
Circl	CVE-2023-41267	14 Sep 202312:24	–	circl
CNNVD	Apache Airflow 安全漏洞	14 Sep 202300:00	–	cnnvd
CNVD	SiYuan Notes Software Web App is a privacy-first personal knowledge management system that supports full offline use as well as end-to-end encrypted synchronization. Yunnan ChainDrop Technology Co., Ltd. has an XSS vulnerability in the Siyuan Notes Software Web application, which can be exploited by attackers to obtain sensitive information such as user cookies.	18 Sep 202300:00	–	cnvd
CVE	CVE-2023-41267	14 Sep 202307:46	–	cve
Cvelist	CVE-2023-41267 Apache HDFS Provider error message suggested installation of incorrect pip package	14 Sep 202307:46	–	cvelist
EUVD	EUVD-2023-2432	3 Oct 202520:07	–	euvd
Tenable Nessus	Fedora 40 : golang-cloud-google / golang-cloud-google-bigquery / etc (2023-f23d9c5057)	29 Apr 202400:00	–	nessus
Github Security Blog	Apache HDFS Provider error message suggested	14 Sep 202309:30	–	github
NVD	CVE-2023-41267	14 Sep 202308:15	–	nvd

[
  {
    "cpes": [
      "cpe:2.3:a:apache:airflow_hdfs_provider:*:*:*:*:*:*:*:*"
    ],
    "vendor": "apache",
    "product": "airflow_hdfs_provider",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "4.1.1",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
lists	www.lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z
openwall	www.openwall.com/lists/oss-security/2023/09/14/3
github	www.github.com/apache/airflow/pull/33813

14 Sep 2023 17:06Current

7.5High risk

Vulners AI Score7.5

EPSS0.00583

SSVC

CWE-829