CVE - CVE-2023-51702

CVE-ID
CVE-2023-51702	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster. This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://github.com/apache/airflow/pull/29498 URL:https://github.com/apache/airflow/pull/29498 MISC:https://github.com/apache/airflow/pull/30110 URL:https://github.com/apache/airflow/pull/30110 MISC:https://github.com/apache/airflow/pull/36492 URL:https://github.com/apache/airflow/pull/36492 MISC:https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9 URL:https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9 MLIST:[oss-security] 20240124 CVE-2023-51702: Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer service URL:http://www.openwall.com/lists/oss-security/2024/01/24/3
Assigning CNA
Apache Software Foundation
Date Record Created
20231221	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20231221)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)