CVE-2023-35798

Published: Jun 27, 2023Modified: Jun 17, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: NVD

Description

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it. This issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1. It is recommended to upgrade to a version that is not affected

Affected (2)

Products: Apache: Apache Airflow Providers Microsoft Mssql, Apache Airflow Providers Odbc

2 products

Apache Airflow Providers Microsoft Mssql

Apache Airflow Providers Odbc

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Apache Apache Airflow Providers Microsoft Mssql	Before 3.4.1
Apache Apache Airflow Providers Odbc	Before 4.0.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://github.com/apache/airflow/pull/31984

Source: security@apache.org

PatchVendor Advisory

https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj

Source: security@apache.org

Mailing ListVendor Advisory

https://github.com/apache/airflow/pull/31984

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.