GHSA-mq4v-6vg4-796c

    Dashboard / Vulnerabilities / GHSA-mq4v-6vg4-796c

    GHSA-mq4v-6vg4-796c

    Published: 11 Aug 2023Last Modified: 7 Jul 2026

    Summary: apache-airflow-providers-apache-drill Improper Input Validation vulnerability

    Details: Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider before 2.4.3. It is recommended to upgrade to a version that is not affected.

    References: https://nvd.nist.gov/vuln/detail/CVE-2023-39553, https://github.com/apache/airflow/pull/33074, https://github.com/apache/airflow/commit/394a727ac2c18d58978bf186a7a92923460ec110, https://github.com/apache/airflow, https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-136.yaml, https://lists.apache.org/thread/ozpl0opmob49rkcz8svo8wkxyw1395sf, https://www.openwall.com/lists/oss-security/2023/08/11/1, http://www.openwall.com/lists/oss-security/2023/08/11/1

    Affected packages

    Package

    Name: apache-airflow-providers-apache-drill

    Purl: pkg:pypi/apache-airflow-providers-apache-drill

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.3

    Affected versions

    1.0.0
    1.0.0rc1
    1.0.0rc2
    1.0.1
    1.0.1rc1
    1.0.2
    1.0.2rc1
    1.0.3
    1.0.3rc1
    1.0.4
    1.0.4rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-mq4v-6vg4-796c | CVE-DB