Critical severity9.8NVD Advisory· Published Jul 3, 2023· Updated Jun 17, 2026
CVE-2023-35797
CVE-2023-35797
Description
Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Provider: before 6.1.1.
Before version 6.1.1 it was possible to bypass the security check to RCE via principal parameter. For this to be exploited it requires access to modifying the connection details.
It is recommended updating provider version to 6.1.1 in order to avoid this vulnerability.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-airflow-providers-apache-hivePyPI | < 6.1.1 | 6.1.1 |
Affected products
3- cpe:2.3:a:apache:apache-airflow-providers-apache-hive:*:*:*:*:*:*:*:*Range: <6.1.1
- Range: 0
Patches
Vulnerability mechanics
References
6- github.com/apache/airflow/pull/31983nvdPatchWEB
- github.com/advisories/GHSA-hg6c-qqcm-r79rghsaADVISORY
- lists.apache.org/thread/30y19ok07fw52x5hnkbhwqo3ho0wwc1ynvdMailing ListVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-35797ghsaADVISORY
- www.openwall.com/lists/oss-security/2023/07/12/3nvdWEB
- github.com/apache/airflow/commit/6724eeb6210d5965937eaf9dae3e476eb30f8268ghsaWEB
News mentions
0No linked articles in our index yet.