Description (CNA)
Apache Airflow's SMTP provider `SmtpHook` called Python's `smtplib.SMTP.starttls()` without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS upgrade, and capture the SMTP credentials sent during the subsequent `login()` call. Users are advised to upgrade to the `apache-airflow-providers-smtp` version that contains the fix.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Apache Software Foundation / Apache Airflow Providers SMTP | affected 2.0.0 before 3.0.0 |
CWE
CWE-295
References
- https://github.com/apache/airflow/pull/65346
- https://lists.apache.org/thread/gb202qy5r31bgdd3d51d7s5o1jh40kc4
ADP enrichment
No English description supplied.
No references supplied.