[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20250406103749.6d75fa6e@hboeck.de>
Date: Sun, 6 Apr 2025 10:37:49 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2025-30473: Apache Airflow Common SQL
Provider: Remote Code Execution via Sql Injection
Hello,
On Fri, 04 Apr 2025 18:54:21 +0000
Elad Kalif <eladkal@...che.org> wrote:
> https://github.com/apache/airflow/pull/48098
If I read this code correctly, the only thing this PR changes is to
reject inputs with an ";" character.
I am not familiar with the codebase, and also by no means an expert in
SQL injections. But I am pretty sure there are ways to exploit SQL
injections that do not involve a ";" character.
Can anyone familiar with the issue check that this is indeed a proper
fix?
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
