CVE-2023-34395
CVSS V2 None
CVSS V3 None
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
Overview
- CVE ID
- CVE-2023-34395
- Assigner
- apache
- Vulnerability Status
- PUBLISHED
- Published Version
- 2023-06-27T11:36:58.116Z
- Last Modified Date
- 2023-06-27T11:36:58.116Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/apache/airflow/pull/31713 | patch |
| https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd | vendor-advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2023-34395 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34395 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-25 20:26:12 | Added to TrackCVE |