cvelistv5 - cve-2022-40954

cve-2022-40954

Vulnerability from cvelistv5

Published

2022-11-22 00:00

Modified

2024-08-03 12:28

Severity ?

Summary

Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files

References

▼	URL	Tags
	security@apache.org	https://github.com/apache/airflow/pull/27646	Patch, Third Party Advisory
	security@apache.org	https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45	Mailing List, Vendor Advisory

Impacted products

▼	Vendor	Product
	Apache Software Foundation	Apache Airflow Spark Provider
	Apache Software Foundation	Apache Airflow

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:28:42.928Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/apache/airflow/pull/27646"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Airflow Spark Provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "4.0.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Apache Airflow",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.3.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Apache Airflow PMC wants to thank id_No2015429 of 3H Security Team for reporting the issue."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed)."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "other": "moderate"
            },
            "type": "unknown"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-22T00:00:00",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "url": "https://github.com/apache/airflow/pull/27646"
        },
        {
          "url": "https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow Spark Provider RCE that bypass restrictions to read arbitrary files",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-40954",
    "datePublished": "2022-11-22T00:00:00",
    "dateReserved": "2022-09-19T00:00:00",
    "dateUpdated": "2024-08-03T12:28:42.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-40954\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2022-11-22T10:15:16.387\",\"lastModified\":\"2022-11-28T17:51:04.027\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) vulnerability in Apache Airflow Spark Provider, Apache Airflow allows an attacker to read arbtrary files in the task execution context, without write access to DAG files. This issue affects Spark Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Spark Provider is installed (Spark Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Spark Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Spark Provider installed).\"},{\"lang\":\"es\",\"value\":\"Neutralizaci\u00f3n inadecuada de elementos especiales utilizados en una vulnerabilidad de comando del sistema operativo (\u0027inyecci\u00f3n de comando del sistema operativo\u0027) en Apache Airflow Spark Provider. Apache Airflow permite a un atacante leer archivos arbitrarios en el contexto de ejecuci\u00f3n de la tarea, sin acceso de escritura a los archivos DAG. Este problema afecta a las versiones del proveedor Spark anteriores a la 4.0.0. Tambi\u00e9n afecta cualquier versi\u00f3n de Apache Airflow anterior a la 2.3.0 en caso de que Spark Provider est\u00e9 instalado (Spark Provider 4.0.0 solo se puede instalar para Airflow 2.3.0+). Tenga en cuenta que debe instalar manualmente Spark Provider versi\u00f3n 4.0.0 para eliminar la vulnerabilidad adem\u00e1s de la versi\u00f3n Airflow 2.3.0+ que tiene instalada una versi\u00f3n inferior de Spark Provider).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.3.0\",\"matchCriteriaId\":\"24BE0EE8-9BCD-4DC8-8400-08A9084A4FFB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-apache-spark:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.0.0\",\"matchCriteriaId\":\"75A3614F-4FAE-4CE9-B135-3151588B1F88\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/27646\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://lists.apache.org/thread/0tmdlnmjs5t4gsx5fy73tb6zd3jztq45\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2022-40954

Vulnerability from cvelistv5

gsd-2022-40954

Vulnerability from gsd

ghsa-45r6-j3cc-6mxx

Vulnerability from github

Tags

Sightings

Nomenclature