Executive brief
The Apache Airflow FTP Provider lacks proper certificate validation when establishing secure FTP_TLS connections, allowing potential man-in-the-middle attacks. This could enable an attacker to intercept FTP traffic that should be protected. Although the severity is low, the issue affects all versions before 3.7.0 and is addressed with an upgrade.
Technical details
This vulnerability is a CWE-295 (Improper Certificate Validation) affecting the FTP hook's FTPS implementation. The hook fails to properly validate SSL certificates during FTP_TLS connections because it does not pass ssl.create_default_context() when instantiating FTP_TLS, leaving the connection vulnerable to man-in-the-middle attacks. The vulnerability requires network-level access to intercept connections but does not require authentication or user interaction. An attacker positioned on the network path can impersonate the FTP server and access transmitted credentials or data. The fix involves implementing proper certificate validation by passing the appropriate SSL context during FTP_TLS instantiation, which is available in Apache Airflow FTP Provider version 3.7.0 and later.
Affected products
- Apache Airflow FTP Provider before 3.7.0
Timeline
- 2024-04-21: disclosed: Published on GitHub Advisory Database
- 2024-03-18: patched: Fix merged in PR #38266 on Apache Airflow main branch
- 2024-04-21: advisory: CVE-2024-29733 / GHSA-3gg8-mc87-cq3h published