Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2022-41131

Apache Airflow Hive Provider vulnerability (command injection via hive_cli connection)

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows an attacker to execute arbtrary commands in the task execution context, without write access to DAG files. This issue affects Hive Provider versions prior to 4.1.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case HIve Provider is installed (Hive Provider 4.1.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the HIve Provider version 4.1.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version that has lower version of the Hive Provider installed).

CVSS 3.1 · 7.8 High EPSS 1.8% KEV · Not listed
Vendors
Apache
Products
Airflow Apache-airflow-providers-apache-hive
CVE-2022-46421

Apache Airflow Hive Provider: Hive Provider RCE vulnerability with hive_cli_params

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.

CVSS 3.1 · 9.8 Critical EPSS 3.3% KEV · Not listed
Vendors
Apache
Products
Apache-airflow-providers-apache-hive
CVE-2023-37415

Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed
Vendors
Apache
Products
Apache-airflow-providers-apache-hive
CVE-2023-35797

Apache Airflow Hive Provider Beeline RCE with Principal

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1. Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details. It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed
Vendors
Apache
Products
Apache-airflow-providers-apache-hive
CVE-2023-25696

Apache Airflow Hive Provider Beeline RCE

Improper Input Validation vulnerability in the Apache Airflow Hive Provider. This issue affects Apache Airflow Hive Provider versions before 5.1.3.

CVSS 3.1 · 9.8 Critical EPSS 2.0% KEV · Not listed
Vendors
Apache
Products
Apache-airflow-providers-apache-hive