What is GHSA-ffj9-4crc-q7wf?

GHSA-ffj9-4crc-q7wf is a security advisory published by GitHub Security Advisories with High severity. Apache Airflow Spark Provider vulnerable to improper input validation

Which CVE IDs does GHSA-ffj9-4crc-q7wf cover?

GHSA-ffj9-4crc-q7wf covers the following CVE IDs: CVE-2023-28710. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ffj9-4crc-q7wf?

GHSA-ffj9-4crc-q7wf has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-ffj9-4crc-q7wf?

GHSA-ffj9-4crc-q7wf affects 1 product, including: pip/apache-airflow-providers-apache-spark:\u003c 4.0.1.

GHSA-ffj9-4crc-q7wfHighCVSS 7.5

Apache Airflow Spark Provider vulnerable to improper input validation

Vendor

GitHub Security Advisories

Published

April 7, 2023

Last Modified

April 14, 2023

🔗 CVE IDs covered (1)

CVE-2023-28710 →

📋 Description

Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain / and ? which is used to denote the end of the field.

🎯 Affected products1

pip/apache-airflow-providers-apache-spark:< 4.0.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2023-28710
https://github.com/apache/airflow/pull/30223
https://lists.apache.org/thread/lb9w9114ow00h2nkn8bjm106v5x1p1d2
http://www.openwall.com/lists/oss-security/2023/04/07/3
https://github.com/advisories/GHSA-ffj9-4crc-q7wf