Paper/Archive/CVE-2023-25691

CVE-2023-25691

Apache Software Foundation Apache Airflow Google Provider — Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution

EPSS 2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 75.8.758 × 2015.2 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.

Affected

ProductAffectedFixed inSource

Apache Airflow Google Provider< 8.10.08.10.0CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/airflow/pull/29497 advisorylists.apache.org/thread/zdr8ovfttbh7kj0lydgcw88tbt2nmkcy