Podatność CVE-2023-34395


Publikacja: 2023-06-27

Opis:
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.
In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.
Starting version 4.0.0 driver can be set only from the hook constructor.
This issue affects Apache Airflow ODBC Provider: before 4.0.0.

Typ:

CWE-88

(Argument Injection or Modification)

 Referencje:
https://github.com/apache/airflow/pull/31713
https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd

Copyright 2024, cxsecurity.com

 

Back to Top