CVE-2023-37415 — Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

Description (CNA)

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Airflow Apache Hive Provider	affected 0 before 6.1.2

CWE

CWE-20

References

https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k
http://www.openwall.com/lists/oss-security/2023/07/12/3

ADP enrichment

CVE

No English description supplied.

https://lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k
http://www.openwall.com/lists/oss-security/2023/07/12/3

CISA-ADP

No English description supplied.

No references supplied.