CVE-2023-25693 Sqoop Apache Airflow Provider Remote Code Execution Vulnerability
Attackers can execute arbitrary code via improper input validation in the Apache Airflow Sqoop Provider.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25693?
CVE-2023-25693 is a critical code injection vulnerability in Apache Airflow Sqoop Provider, published on 24 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider.
This issue affects Apache Airflow Sqoop Provider versions before 3.1.1.
Weakness: CWE-20
Which versions are affected by CVE-2023-25693?
4 open source packages ship an affected version, including apache-airflow-providers-apache-sqoop and apache-airflow. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache-airflow-providers-apache-sqoop PyPI | All versions | 3.1.1 |
apache-airflow-providers-apache-sqoop PyPI | All versions | 3.1.1 |
apache-airflow-providers-apache-sqoop PyPI | All versions | 3.1.1 |
apache-airflow PyPI | All versions | 3.1.1 |
Products include Apache Apache-Airflow-Providers-Apache-Sqoop.
How do I fix CVE-2023-25693?
Upgrade apache-airflow-providers-apache-sqoop to 3.1.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-25693 being exploited?
There is no known exploitation of CVE-2023-25693 in the wild and no public exploit code.
Sources
Also known as GHSA-j69x-v4wc-3fpf, PYSEC-2023-314, PYSEC-2026-275.