Bug 2250102 (CVE-2023-47037)

Summary: CVE-2023-47037 Apache Airflow: missing fix for CVE-2023-40611 (DAG run broken access)
Product: [Other] Security Response Reporter: Mauro Matteo Cascella <mcascell>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2250103    
Bug Blocks:    

Description Mauro Matteo Cascella 2023-11-16 16:29:28 UTC 
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. 

Users should upgrade to version 2.7.3 or later which has removed the vulnerability.

References:
https://github.com/apache/airflow/pull/33413
https://lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
http://www.openwall.com/lists/oss-security/2023/11/12/1
Comment 1 Mauro Matteo Cascella 2023-11-16 16:29:40 UTC 
Created golang-cloud-google tracking bugs for this issue:

Affects: fedora-all [bug 2250103]