Apache Airflow allows authenticated and DAG-view authorized users to modify some DAG run detail values when submitting notes

中 4.3CVE-2023-47037 · BIT-airflow-2023-47037 · GHSA-hm9r-7f84-25c9 · 12/11/2023 公開 · 17/06/2026 更新

要点

CVE-2023-47037 は apache-airflow, airflow (apache) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.5%（全脆弱性の 74.2% より高い）。
対処：2.7.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow PyPI	`< 2.7.3`	`2.7.3`
airflow apache	`< 2.7.3`	`2.7.3`

概要

Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

NVD の説明

We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.