Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
Vulnerability Description
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-29733
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Eric Brown of Secure Sauce LLC
References
- https://github.com/apache/airflow/pull/38266
- https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280
- https://docs.python.org/3/library/ssl.html#best-defaults
- https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2
- http://www.openwall.com/lists/oss-security/2024/04/19/3
More from Apache Software Foundation
View All →Affected Vendor
Apache Software Foundation
View all reports →