In breve
- CVE-2023-34395 è una vulnerabilità ALTO (CVSS 7.8) che riguarda apache-airflow-providers-odbc, apache-airflow-providers-odbc (apache).
- Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.76%, superiore al 55.3% delle vulnerabilità.
- Correzione: aggiornare a 4.0.0 o successiva.
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
NVD description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.
Altre vulnerabilità di apache-airflow-providers-odbc
Vedi tutto →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free