Xie Jianming

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Sqoop Provider versions prior to 4.0.0 **Description** The issue is related to insufficient input validation, which can be exploited by a remote attacker to execute arbitrary code. This can be achieved by passing parameters with connections, making it possible to implement RCE attacks via `sqoop import --connect`, and obtain Airflow server permissions. The attacker needs to be logged in and have authorization to create or edit connections. **Recommendations** To resolve the issue, upgrade to a version that is not affected, specifically version 4.0.0 or later. As a temporary workaround, consider restricting access to the `sqoop import --connect` command to minimize the risk of exploitation. Additionally, limit the ability to create or edit connections to authorized personnel only.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Spark Provider versions prior to 4.0.1 **Description** The issue is related to improper input validation in the Apache Airflow Spark Provider. This allows the host and schema of JDBC Hook to contain `/` and `?`, which can be used to denote the end of the field. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited. **Recommendations** For versions prior to 4.0.1, update to version 4.0.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the JDBC Hook to minimize the risk of exploitation. Avoid using the `/` and `?` characters in the host and schema of the JDBC Hook until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Google Provider versions prior to 8.10.0 **Description** The issue is related to an Improper Input Validation vulnerability in the Apache Airflow Google Provider. **Recommendations** For versions prior to 8.10.0, update to version 8.10.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apache Airflow Google Provider versions prior to 8.10.0 **Description** The issue is related to an Improper Input Validation vulnerability in the Apache Airflow Google Provider. This vulnerability can potentially lead to a Denial of Service and Remote Command Execution. **Recommendations** For versions prior to 8.10.0, update to version 8.10.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Google Cloud Sql Provider to minimize the risk of exploitation.