CVE - CVE-2024-29733

CVE-ID
CVE-2024-29733	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://docs.python.org/3/library/ssl.html#best-defaults URL:https://docs.python.org/3/library/ssl.html#best-defaults MISC:https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 URL:https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 MISC:https://github.com/apache/airflow/pull/38266 URL:https://github.com/apache/airflow/pull/38266 MISC:https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 URL:https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 MLIST:[oss-security] 20240419 CVE-2024-29733: Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context URL:http://www.openwall.com/lists/oss-security/2024/04/19/3
Assigning CNA
Apache Software Foundation
Date Record Created
20240319	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240319)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)