QwikSec

Security Database

CVE

CWE

Training

CVE-2023-41267

Published: Sep 14, 2023

Modified: Feb 13, 2025

PUBLISHED

Description

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

Vendor	Product	Versions
Apache Software Foundation	Apache Airflow HDFS Provider	affected `0 - < 4.1.1`

Weaknesses (CWE)

References

https://github.com/apache/airflow/pull/33813

patch

https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z

vendor-advisory

http://www.openwall.com/lists/oss-security/2023/09/14/3

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.