CVE-2023-35798

Name of the Vulnerable Software and Affected Versions Apache Airflow ODBC Provider versions prior to 4.0.0 Apache Airflow MSSQL Provider versions prior to 3.4.1

Description The issue is related to insufficient input validation in the Apache Airflow MSSQL Provider and Airflow ODBC Provider modules. This allows a remote attacker to access protected information. The vulnerability is considered low because it requires DAG code to use get sqlalchemy connection and someone with access to connection resources to update the connection and exploit it.

Recommendations For Apache Airflow ODBC Provider versions prior to 4.0.0, upgrade to a version that is not affected. For Apache Airflow MSSQL Provider versions prior to 3.4.1, upgrade to a version that is not affected. As a temporary workaround, consider restricting access to the get sqlalchemy connection function until a patch is available.