CVE-2023-39553

    Dashboard / Vulnerabilities / CVE-2023-39553

    CVE-2023-39553

    Published: 11 Aug 2023Last Modified: 12 Aug 2026

    Summary: Apache Airflow Drill Provider Arbitrary File Read Vulnerability

    Details: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected.

    References: http://www.openwall.com/lists/oss-security/2023/08/11/1, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39553.json, https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf, https://nvd.nist.gov/vuln/detail/CVE-2023-39553, https://github.com/apache/airflow/pull/33074

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d7dbfb7e26a50130d3550e781dc71a5fbcaeb3d2

    Affected versions

    providers-zendesk/3.0.2rc1
    providers-zendesk/3.0.2
    providers-zendesk/3.0.1rc1
    providers-zendesk/3.0.1
    providers-zendesk/3.0.0rc2
    providers-zendesk/3.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39553 | CVE-DB