gsd-2023-51702
Vulnerability from gsd
Modified
2023-12-22 06:01
Details
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
Aliases


To clipboard 

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-51702"
      ],
      "details": "Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.\n\nThis behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.",
      "id": "GSD-2023-51702",
      "modified": "2023-12-22T06:01:25.350392Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@apache.org",
        "ID": "CVE-2023-51702",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Apache Airflow CNCF Kubernetes provider",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "5.2.0",
                          "version_value": "7.0.0"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Apache Airflow",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "2.3.0",
                          "version_value": "2.6.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Apache Software Foundation"
            }
          ]
        }
      },
      "credits": [
        {
          "lang": "en",
          "value": "Hussein Awala"
        },
        {
          "lang": "en",
          "value": "Hussein Awala"
        }
      ],
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.\n\nThis behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue."
          }
        ]
      },
      "generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-532",
                "lang": "eng",
                "value": "CWE-532 Insertion of Sensitive Information into Log File"
              }
            ]
          },
          {
            "description": [
              {
                "cweId": "CWE-312",
                "lang": "eng",
                "value": "CWE-312 Cleartext Storage of Sensitive Information"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/apache/airflow/pull/29498",
            "refsource": "MISC",
            "url": "https://github.com/apache/airflow/pull/29498"
          },
          {
            "name": "https://github.com/apache/airflow/pull/30110",
            "refsource": "MISC",
            "url": "https://github.com/apache/airflow/pull/30110"
          },
          {
            "name": "https://github.com/apache/airflow/pull/36492",
            "refsource": "MISC",
            "url": "https://github.com/apache/airflow/pull/36492"
          },
          {
            "name": "https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9",
            "refsource": "MISC",
            "url": "https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2024/01/24/3",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2024/01/24/3"
          }
        ]
      },
      "source": {
        "discovery": "INTERNAL"
      }
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6592EF36-124C-4817-AAA7-33E0D5C1AB57",
                    "versionEndExcluding": "2.6.1",
                    "versionStartIncluding": "2.3.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:apache:airflow_cncf_kubernetes:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FD1C8DDC-BBE7-494E-87EF-F478DB8453C0",
                    "versionEndExcluding": "7.0.0",
                    "versionStartIncluding": "5.2.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.\n\nThis behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue."
          },
          {
            "lang": "es",
            "value": "Desde la versi\u00f3n 5.2.0, cuando se utiliza el modo diferible con la ruta de un archivo de configuraci\u00f3n de Kubernetes para la autenticaci\u00f3n, el trabajador de Airflow serializa este archivo de configuraci\u00f3n como un diccionario y lo env\u00eda al activador almacen\u00e1ndolo en metadatos sin ning\u00fan cifrado. Adem\u00e1s, si se utiliza con una versi\u00f3n de Airflow entre 2.3.0 y 2.6.0, el diccionario de configuraci\u00f3n se registrar\u00e1 como texto plano en el servicio activador sin enmascaramiento. Esto permite que cualquier persona con acceso a los metadatos o al registro del activador obtenga el archivo de configuraci\u00f3n y lo utilice para acceder al cl\u00faster de Kubernetes. Este comportamiento se cambi\u00f3 en la versi\u00f3n 7.0.0, que dej\u00f3 de serializar el contenido del archivo y comenz\u00f3 a proporcionar la ruta del archivo para leer el contenido en el activador. Se recomienda a los usuarios actualizar a la versi\u00f3n 7.0.0, que soluciona este problema."
          }
        ],
        "id": "CVE-2023-51702",
        "lastModified": "2024-01-30T23:00:53.027",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2024-01-24T13:15:08.150",
        "references": [
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Third Party Advisory"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/01/24/3"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/apache/airflow/pull/29498"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/apache/airflow/pull/30110"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Issue Tracking",
              "Patch"
            ],
            "url": "https://github.com/apache/airflow/pull/36492"
          },
          {
            "source": "security@apache.org",
            "tags": [
              "Mailing List",
              "Vendor Advisory"
            ],
            "url": "https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9"
          }
        ],
        "sourceIdentifier": "security@apache.org",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-312"
              },
              {
                "lang": "en",
                "value": "CWE-532"
              }
            ],
            "source": "security@apache.org",
            "type": "Primary"
          }
        ]
      }
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.