Paper/Archive/CVE-2024-25141

CVE-2024-25141

Apache Software Foundation Apache Airflow Mongo Provider — Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

EPSS 0.6%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 50.0.500 × 2010.0 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

Affected

ProductAffectedFixed inSource

Apache Airflow Mongo Provider1.0.0 – < 4.0.04.0.0CNA

airflow_mongo_providerall versions–CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/apache/airflow/pull/37214 advisorylists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm refopenwall.com/lists/oss-security/2024/02/20/5