Improper access control in Apache Airflow - CVE-2023-40611,CVE-2023-47037

Vulnerability identifier: #VU83544

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-40611,CVE-2023-47037

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote authenticated and DAG-view authorized user can modify some DAG run detail values when submitting notes.

Note, the vulnerability was reported as patched in version 2.7.1, however the vendor has failed to apply it.

Apache Airflow
Fedora
golang-cloud-google-compute-metadata
golang-cloud-google-longrunning
golang-cloud-google
golang-cloud-google-iam
golang-cloud-google-logging
golang-cloud-google-trace
golang-cloud-google-secretmanager
golang-cloud-google-osconfig
golang-cloud-google-firestore
golang-cloud-google-datastore
golang-cloud-google-kms
golang-cloud-google-monitoring
golang-cloud-google-datacatalog
golang-cloud-google-compute
golang-cloud-google-pubsub
golang-cloud-google-storage
golang-cloud-google-spanner
golang-cloud-google-bigquery

Install updates from vendor's website.

Apache Airflow - update to 2.7.3
golang-cloud-google-compute-metadata - update to 0.2.3-1.fc40~bootstrap
golang-cloud-google-longrunning - update to 0.5.3-1.fc40~bootstrap
golang-cloud-google - update to 0.110.9-1.fc40~bootstrap
golang-cloud-google-iam - update to 1.1.4-1.fc40~bootstrap
golang-cloud-google-logging - update to 1.8.1-1.fc40~bootstrap
golang-cloud-google-trace - update to 1.10.3-1.fc40~bootstrap
golang-cloud-google-secretmanager - update to 1.11.3-1.fc40~bootstrap
golang-cloud-google-osconfig - update to 1.12.3-1.fc40~bootstrap
golang-cloud-google-firestore - update to 1.14.0-1.fc40~bootstrap
golang-cloud-google-datastore - update to 1.15.0-1.fc40~bootstrap
golang-cloud-google-kms - update to 1.15.4-1.fc40~bootstrap
golang-cloud-google-monitoring - update to 1.16.2-1.fc40~bootstrap
golang-cloud-google-datacatalog - update to 1.18.2-1.fc40~bootstrap
golang-cloud-google-compute - update to 1.23.2-1.fc40~bootstrap
golang-cloud-google-pubsub - update to 1.33.0-1.fc40~bootstrap
golang-cloud-google-storage - update to 1.33.0-1.fc40~bootstrap
golang-cloud-google-spanner - update to 1.51.0-1.fc40~bootstrap
golang-cloud-google-bigquery - update to 1.56.0-1.fc40~bootstrap

• https://github.com/apache/airflow/pull/33413
• https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
• http://www.openwall.com/lists/oss-security/2023/11/12/1

• Improper access control in Apache Airflow
• Fedora 40 update for golang-cloud-google, golang-cloud-google-bigquery, golang-cloud-google-compute, golang-cloud-google-compute-metadata, golang-cloud-google-datacatalog, golang-cloud-google-datastore, golang-cloud-google-firestore, golang-cloud-google-i