[<prev] [next>] [day] [month] [year] [list]
Message-ID: <1bb350d2-56b0-4ee2-c925-d92bb64d9f44@apache.org>
Date: Tue, 20 Feb 2024 19:31:59 +0000
From: Elad Kalif <eladkal@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-25141: Apache Airflow Mongo Provider: Certificate
validation isn't respected even if SSL is enabled for
apache-airflow-providers-mongo
Severity: low
Affected versions:
- Apache Airflow Mongo Provider 1.0.0 before 4.0.0
Description:
When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented.
Users are recommended to upgrade to version 4.0.0, which fixes this issue.
Credit:
Noah Stapp (reporter)
References:
https://github.com/apache/airflow/pull/37214
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-25141
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
