CVE-2024-29733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-29733
Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.

2.7 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://www.openwall.com/lists/oss-security/2024/04/19/3
https://docs.python.org/3/library/ssl.html#best-defaults
https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280
https://github.com/apache/airflow/pull/38266
https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2
http://www.openwall.com/lists/oss-security/2024/04/19/3
https://docs.python.org/3/library/ssl.html#best-defaults
https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280
https://github.com/apache/airflow/pull/38266
https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2
Configurations

No configuration.

History

13 Feb 2025, 18:17

Type Values Removed Values Added
Summary (en) Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue. (en) Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.

21 Nov 2024, 09:08

Type Values Removed Values Added
References () http://www.openwall.com/lists/oss-security/2024/04/19/3 - () http://www.openwall.com/lists/oss-security/2024/04/19/3 -
References () https://docs.python.org/3/library/ssl.html#best-defaults - () https://docs.python.org/3/library/ssl.html#best-defaults -
References () https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 - () https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280 -
References () https://github.com/apache/airflow/pull/38266 - () https://github.com/apache/airflow/pull/38266 -
References () https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 - () https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2 -

03 Jul 2024, 01:52

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 2.7

01 May 2024, 18:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2024/04/19/3 -

22 Apr 2024, 13:28

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de validación de certificado incorrecta en el proveedor FTP Apache Airflow. El enlace FTP carece de una validación completa del certificado en las conexiones FTP_TLS, lo que potencialmente puede aprovecharse. La implementación de una validación de certificados adecuada pasando context=ssl.create_default_context() durante la creación de instancias de FTP_TLS se utiliza como mitigación para validar los certificados correctamente. Este problema afecta al proveedor FTP Apache Airflow: anterior a 3.7.0. Se recomienda a los usuarios actualizar a la versión 3.7.0, que soluciona el problema.

21 Apr 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-21 18:15

Updated : 2025-02-13 18:17

NVD link : CVE-2024-29733

Mitre link : CVE-2024-29733

CVE.ORG link : CVE-2024-29733

JSON object : View

Products Affected

No product.

CWE
CWE-295

Improper Certificate Validation