Inclusion of functionality from untrusted control sphere in Apache Airflow HDFS provider - CVE-2023-41267

Vulnerability identifier: #VU83624

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-41267

CWE-ID: CWE-829

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability is caused by an error in software documentation, which instructed users to install an unclaimed pip package. An attacker could claim the package name and potentially compromise the affected system.

Apache Airflow HDFS provider
Fedora
golang-cloud-google-compute-metadata
golang-cloud-google-longrunning
golang-cloud-google
golang-cloud-google-iam
golang-cloud-google-logging
golang-cloud-google-trace
golang-cloud-google-secretmanager
golang-cloud-google-osconfig
golang-cloud-google-firestore
golang-cloud-google-datastore
golang-cloud-google-kms
golang-cloud-google-monitoring
golang-cloud-google-datacatalog
golang-cloud-google-compute
golang-cloud-google-pubsub
golang-cloud-google-storage
golang-cloud-google-spanner
golang-cloud-google-bigquery

Install updates from vendor's website.

Apache Airflow HDFS provider - update to 4.1.1
golang-cloud-google-compute-metadata - update to 0.2.3-1.fc40~bootstrap
golang-cloud-google-longrunning - update to 0.5.3-1.fc40~bootstrap
golang-cloud-google - update to 0.110.9-1.fc40~bootstrap
golang-cloud-google-iam - update to 1.1.4-1.fc40~bootstrap
golang-cloud-google-logging - update to 1.8.1-1.fc40~bootstrap
golang-cloud-google-trace - update to 1.10.3-1.fc40~bootstrap
golang-cloud-google-secretmanager - update to 1.11.3-1.fc40~bootstrap
golang-cloud-google-osconfig - update to 1.12.3-1.fc40~bootstrap
golang-cloud-google-firestore - update to 1.14.0-1.fc40~bootstrap
golang-cloud-google-datastore - update to 1.15.0-1.fc40~bootstrap
golang-cloud-google-kms - update to 1.15.4-1.fc40~bootstrap
golang-cloud-google-monitoring - update to 1.16.2-1.fc40~bootstrap
golang-cloud-google-datacatalog - update to 1.18.2-1.fc40~bootstrap
golang-cloud-google-compute - update to 1.23.2-1.fc40~bootstrap
golang-cloud-google-pubsub - update to 1.33.0-1.fc40~bootstrap
golang-cloud-google-storage - update to 1.33.0-1.fc40~bootstrap
golang-cloud-google-spanner - update to 1.51.0-1.fc40~bootstrap
golang-cloud-google-bigquery - update to 1.56.0-1.fc40~bootstrap

• https://github.com/apache/airflow/pull/33813
• https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z
• http://www.openwall.com/lists/oss-security/2023/09/14/3

• Inclusion of functionality from untrusted control sphere in Apache Airflow HDFS Provider
• Fedora 40 update for golang-cloud-google, golang-cloud-google-bigquery, golang-cloud-google-compute, golang-cloud-google-compute-metadata, golang-cloud-google-datacatalog, golang-cloud-google-datastore, golang-cloud-google-firestore, golang-cloud-google-i