Improper Certificate Validation in apache airflow mongo hook

CRÍTICO 9.1CVE-2024-25141 · GHSA-x5pm-h33q-cjrw · PYSEC-2026-278 · Published 20/02/2024 · updated 17/06/2026

Em resumo

CVE-2024-25141 é uma vulnerabilidade CRÍTICO (CVSS 9.1) que afeta apache-airflow-providers-mongo, apache-airflow-providers-mongo (apache).
Chance de exploração nos próximos 30 dias (EPSS): 0.63%, maior que 50.2% das vulnerabilidades.
Correção: atualize para 4.0.0 ou posterior.

Package	Affected versions	Patched versions
apache-airflow-providers-mongo PyPI	`< 4.0.0`	`4.0.0`
apache-airflow-providers-mongo apache	`≥ 1.0.0, < 4.0.0`	`4.0.0`

Description

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2024-25141 · ADVISORY
apache/airflow#37214 · WEB
apache/airflow · PACKAGE
pypa/advisory-database · WEB
lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm · WEB
pypi.org/project/apache-airflow-providers-mongo · WEB
openwall.com/lists/oss-security/2024/02/20/5 · WEB
GitHub Advisory GHSA-x5pm-h33q-cjrw · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

apache-airflow-providers-mongo

PyPI

< 4.0.0

4.0.0

apache-airflow-providers-mongo

apache

≥ 1.0.0, < 4.0.0

4.0.0

Description

NVD description