Apache Airflow Spark Provider vulnerable to improper input validation
High severity
GitHub Reviewed
Published
Apr 7, 2023
to the GitHub Advisory Database
•
Updated Apr 14, 2023
Package
Affected versions
< 4.0.1
Patched versions
4.0.1
Description
Published by the National Vulnerability Database
Apr 7, 2023
Published to the GitHub Advisory Database
Apr 7, 2023
Reviewed
Apr 7, 2023
Last updated
Apr 14, 2023
Apache Software Foundation Apache Airflow Spark Provider before 4.0.1 is vulnerable to improper input validation because the host and schema of JDBC Hook can contain
/
and?
which is used to denote the end of the field.References