Severity
High
Analysis Summary
CVE-2023-33234
Apache Airflow CNCF Kubernetes Provider could allow a remote attacker to execute arbitrary code on the system, caused by a flaw in the KubernetesPodOperator. By sending a specially crafted request using connection configuration, an attacker could exploit this vulnerability to execute arbitrary code on the system.
Impact
- Code Execution
Indicators Of Compromise
CVE
- CVE-2023-33234
Affected Vendors
Apache
Affected Products
- Apache Airflow CNCF Kubernetes Provider 5.0.0
- Apache Airflow CNCF Kubernetes Provider 6.1.0
Remediation
Upgrade to the latest version of Apache Airflow CNCF Kubernetes Provider, available from the Apache Website.