Is CVE-2023-25693 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-25693 being exploited in the wild.

How severe is CVE-2023-25693?

Critical severity, with a CVSS score of 9.8, published 24 February 2023.

Which products and versions are affected?

apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.1; apache-airflow-providers-apache-sqoop (PyPI) < 3.1.1, ECOSYSTEM:introduced=0,fixed=3.1.1.

Is there a fix for CVE-2023-25693?

Yes. apache-airflow (PyPI): upgrade to 3.1.1 or later; apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-25693 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-25693?

Check whether you run Apache Software Foundation Airflow Providers Apache Sqoop, apache-airflow (PyPI) or apache-airflow-providers-apache-sqoop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25693: Apache Airflow Sqoop Provider improper input validation

Q: Is there a fix for CVE-2023-25693?

Yes. apache-airflow (PyPI): upgrade to 3.1.1 or later; apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-25693 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-25693?

Check whether you run Apache Software Foundation Airflow Providers Apache Sqoop, apache-airflow (PyPI) or apache-airflow-providers-apache-sqoop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-25693 · Severity: critical · CVSS 9.8 · Published 2023-02-24

The Apache Airflow Sqoop Provider, a tool used to transfer data between Apache Hadoop and structured datastores, contains a critical security flaw. This vulnerability allows an attacker to bypass security checks by providing improperly formatted input. If exploited, this could lead to unauthorized access to sensitive data or complete control over the data transfer process, potentially disrupting business operations and compromising customer information.

Technologies: apache-airflow (PyPI). Vendors: Apache Software Foundation, PyPI.

Quick answers

Is CVE-2023-25693 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-25693 being exploited in the wild.
How severe is CVE-2023-25693?: Critical severity, with a CVSS score of 9.8, published 24 February 2023.
Which products and versions are affected?: apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=3.1.1; apache-airflow-providers-apache-sqoop (PyPI) < 3.1.1, ECOSYSTEM:introduced=0,fixed=3.1.1.
Is there a fix for CVE-2023-25693?: Yes. apache-airflow (PyPI): upgrade to 3.1.1 or later; apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-25693 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-25693?: Check whether you run Apache Software Foundation Airflow Providers Apache Sqoop, apache-airflow (PyPI) or apache-airflow-providers-apache-sqoop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 3.1.1 or later
```
pip install "apache-airflow>=3.1.1"
```
apache-airflow-providers-apache-sqoop (PyPI): upgrade to 3.1.1 or later
```
pip install "apache-airflow-providers-apache-sqoop>=3.1.1"
```

Technical details

An improper input validation vulnerability (CWE-20) exists in the Apache Airflow Sqoop Provider prior to version 3.1.1. The flaw is related to how parameters like 'libjars' are handled within the Sqoop Hook and Operator. A remote attacker can exploit this by providing specially crafted input that is not correctly validated before being processed by the underlying Hadoop argument-parsing system. This can lead to unauthorized command execution or data access with the privileges of the Airflow worker. The issue was addressed in version 3.1.1 by moving the 'libjars' parameter from connection configuration to Hook parameters to ensure better control and validation.

Affected products

Apache apache-airflow-providers-apache-sqoop < 3.1.1

Identifiers

CVE-2023-25693
GHSA-j69x-v4wc-3fpf
PYSEC-2023-314
PYSEC-2026-275

Timeline

2023-02-12: other: Pull request to fix the issue submitted
2023-02-24: advisory: Initial disclosure and GHSA/CVE publication
2023-02-24: patched: Version 3.1.1 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.