CVE-2023-25956 - Vulnerability Details - OpenCVE

Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.

This issue affects Apache Airflow AWS Provider versions before 7.2.1.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00293.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Apache	Apache-airflow-providers-amazon

Configuration 1 [-]

cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/apache/airflow/pull/29587
https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv

History

Wed, 23 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2023-02-24T11:48:33.110Z

Updated: 2024-10-23T16:44:57.125Z

Reserved: 2023-02-17T10:12:03.880Z

Link: CVE-2023-25956

Vulnrichment

Updated: 2024-08-02T11:39:06.134Z

NVD

Status : Modified

Published: 2023-02-24T12:15:30.867

Modified: 2024-11-21T07:50:30.970

Link: CVE-2023-25956

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-25956", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2023-02-17T10:12:03.880Z", "datePublished": "2023-02-24T11:48:33.110Z", "dateUpdated": "2024-10-23T16:44:57.125Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Apache Airflow AWS Provider", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "7.2.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Using the \"AWS\" Provider for Apache Airflow<br>"}], "value": "Using the \"AWS\" Provider for Apache Airflow\n"}], "credits": [{"lang": "en", "type": "finder", "value": "Son Tran from VNPT - VCI"}, {"lang": "en", "type": "finder", "value": "kuteminh11"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.<br><br><p>This issue affects Apache Airflow AWS Provider versions before 7.2.1.</p>"}], "value": "Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.\n\nThis issue affects Apache Airflow AWS Provider versions before 7.2.1.\n\n"}], "metrics": [{"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-03-07T08:23:44.307Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/29587"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow AWS Provider: Arbitrary file read via AWS provider", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:39:06.134Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/apache/airflow/pull/29587"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv"}]}, {"affected": [{"vendor": "apache", "product": "apache-airflow-providers-amazon", "cpes": ["cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "7.2.1", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-23T16:43:26.908971Z", "id": "CVE-2023-25956", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T16:44:57.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/apache/airflow/pull/29587", "tags": ["patch", "x_transferred"]}, {"url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T11:39:06.134Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-25956", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-23T16:43:26.908971Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "apache-airflow-providers-amazon", "versions": [{"status": "affected", "version": "0", "lessThan": "7.2.1", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-23T16:44:49.226Z"}}], "cna": {"title": "Apache Airflow AWS Provider: Arbitrary file read via AWS provider", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Son Tran from VNPT - VCI"}, {"lang": "en", "type": "finder", "value": "kuteminh11"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow AWS Provider", "versions": [{"status": "affected", "version": "0", "lessThan": "7.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/29587", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.\n\nThis issue affects Apache Airflow AWS Provider versions before 7.2.1.\n\n", "supportingMedia": [{"type": "text/html", "value": "Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.<br><br><p>This issue affects Apache Airflow AWS Provider versions before 7.2.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209 Generation of Error Message Containing Sensitive Information"}]}], "configurations": [{"lang": "en", "value": "Using the \"AWS\" Provider for Apache Airflow\n", "supportingMedia": [{"type": "text/html", "value": "Using the \"AWS\" Provider for Apache Airflow<br>", "base64": false}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2023-03-07T08:23:44.307Z"}}}, "cveMetadata": {"cveId": "CVE-2023-25956", "state": "PUBLISHED", "dateUpdated": "2024-10-23T16:44:57.125Z", "dateReserved": "2023-02-17T10:12:03.880Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2023-02-24T11:48:33.110Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-amazon:*:*:*:*:*:*:*:*", "matchCriteriaId": "0DE8C871-ABF3-4BE7-9E62-703DB1EC7978", "versionEndExcluding": "7.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Generation of Error Message Containing Sensitive Information vulnerability in the Apache Airflow AWS Provider.\n\nThis issue affects Apache Airflow AWS Provider versions before 7.2.1.\n\n"}, {"lang": "es", "value": "Generaci\u00f3n de vulnerabilidad de mensaje de error que contiene informaci\u00f3n confidencial en el proveedor AWS Apache Airflow. Este problema afecta a las versiones del proveedor AWS de Apache Airflow anteriores a la 7.2.1."}], "id": "CVE-2023-25956", "lastModified": "2024-11-21T07:50:30.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-02-24T12:15:30.867", "references": [{"source": "security@apache.org", "tags": ["Patch"], "url": "https://github.com/apache/airflow/pull/29587"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/apache/airflow/pull/29587"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/07pl9y4gdpw2c6rzqm77dvkm2z2kb5gv"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security@apache.org", "type": "Secondary"}]}