Apache Airflow Apache Hive Provider Improper Input Validation vulnerability

HIGH 8.8CVE-2023-37415 · GHSA-4q2q-q5pw-2342 · PYSEC-2026-1139 · Published 13/07/2023 · updated 17/06/2026

In short

CVE-2023-37415 is a HIGH (CVSS 8.8) vulnerability affecting apache-airflow-providers-apache-hive, apache-airflow-providers-apache-hive (apache).
Chance of exploitation in the next 30 days (EPSS): 1.6%, higher than 75.6% of all vulnerabilities.
Fix: update to 6.1.2 or later.

Package	Affected versions	Patched versions
apache-airflow-providers-apache-hive PyPI	`< 6.1.2`	`6.1.2`
apache-airflow-providers-apache-hive apache	`< 6.1.2`	`6.1.2`

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.

Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon.

This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.

It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

NVD description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider. Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon. This issue affects Apache Airflow Apache Hive Provider: before 6.1.2. It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

References

nvd.nist.gov/vuln/detail/CVE-2023-37415 · ADVISORY
apache/airflow · PACKAGE
lists.apache.org/thread/9wx0jlckbnycjh8nj5qfwxo423zvm41k · WEB
openwall.com/lists/oss-security/2023/07/12/3 · WEB
pypi.org/project/apache-airflow-providers-apache-hive · PACKAGE
GitHub Advisory GHSA-4q2q-q5pw-2342 · ADVISORY

More vulnerabilities in apache-airflow-providers-apache-hive

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow-providers-apache-hive

PyPI

< 6.1.2

6.1.2

apache-airflow-providers-apache-hive

apache

< 6.1.2

6.1.2

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.

Patching on top of CVE-2023-35797 Before 6.1.2 the proxy_user option can also inject semicolon.

This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.

It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

NVD description

More vulnerabilities in apache-airflow-providers-apache-hive

See all →