cve-2023-39441
Vulnerability from cvelistv5
Published
2023-08-23 15:39
Modified
2025-02-13 17:03
Severity ?
Summary
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability. The default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position. Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability
References
security@apache.orghttp://www.openwall.com/lists/oss-security/2023/08/23/2Mailing List, Patch, Third Party Advisory
security@apache.orghttps://github.com/apache/airflow/pull/33070Patch
security@apache.orghttps://github.com/apache/airflow/pull/33075Patch
security@apache.orghttps://github.com/apache/airflow/pull/33108Patch
security@apache.orghttps://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lbMailing List, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2023/08/23/2Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/airflow/pull/33070Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/airflow/pull/33075Patch
af854a3a-2127-422b-91ae-364da2661108https://github.com/apache/airflow/pull/33108Patch
af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lbMailing List, Patch, Vendor Advisory
Impacted products
Vendor Product Version
Apache Software Foundation Apache Airflow SMTP Provider Version: 0   ≤
Create a notification for this product.
   Apache Software Foundation Apache Airflow IMAP Provider Version: 0   ≤
Create a notification for this product.
   Apache Software Foundation Apache Airflow Version: 0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T18:10:20.689Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/airflow/pull/33075",
               },
               {
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/airflow/pull/33108",
               },
               {
                  tags: [
                     "patch",
                     "x_transferred",
                  ],
                  url: "https://github.com/apache/airflow/pull/33070",
               },
               {
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2023/08/23/2",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-39441",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-09-27T20:31:29.615848Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-09-27T20:31:38.779Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "Apache Airflow SMTP Provider",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThan: "1.30",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Apache Airflow IMAP Provider",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThan: "3.3.0",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
            {
               defaultStatus: "unaffected",
               product: "Apache Airflow",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThan: "2.7.0",
                     status: "affected",
                     version: "0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Martin Schobert, Pentagrid AG",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<span style=\"background-color: rgb(255, 255, 255);\">Apache Airflow SMTP Provider </span><span style=\"background-color: rgb(255, 255, 255);\">before 1.3.0</span><span style=\"background-color: rgb(255, 255, 255);\">, Apache Airflow IMAP Provider </span><span style=\"background-color: rgb(255, 255, 255);\">before 3.3.0, and</span><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;Apache Airflow </span><span style=\"background-color: rgb(255, 255, 255);\">before 2.7.0 are affected by the&nbsp;</span>Validation of OpenSSL Certificate vulnerability.<br><br><span style=\"background-color: rgb(255, 255, 255);\">The default SSL context with SSL library did not check a server's X.509&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">certificate.&nbsp; Instead, the code accepted any certificate, which could&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">result in the disclosure of mail server credentials or mail contents&nbsp;</span><span style=\"background-color: rgb(255, 255, 255);\">when the client connects to an attacker in a MITM position.<br><br></span><span style=\"background-color: var(--wht);\">Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability</span>",
                  },
               ],
               value: "Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.\n\nThe default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.\n\nUsers are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     text: "moderate",
                  },
                  type: "Textual description of severity",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-295",
                     description: "CWE-295 Improper Certificate Validation",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-08-23T15:40:07.139Z",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/apache/airflow/pull/33075",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/apache/airflow/pull/33108",
            },
            {
               tags: [
                  "patch",
               ],
               url: "https://github.com/apache/airflow/pull/33070",
            },
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb",
            },
            {
               url: "http://www.openwall.com/lists/oss-security/2023/08/23/2",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2023-39441",
      datePublished: "2023-08-23T15:39:51.632Z",
      dateReserved: "2023-08-02T12:26:27.028Z",
      dateUpdated: "2025-02-13T17:03:05.348Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2023-39441\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2023-08-23T16:15:09.617\",\"lastModified\":\"2024-11-21T08:15:26.090\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.\\n\\nThe default SSL context with SSL library did not check a server's X.509 certificate.  Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.\\n\\nUsers are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability\"},{\"lang\":\"es\",\"value\":\"Apache Airflow SMTP Provider antes de 1.3.0, Apache Airflow IMAP Provider antes de 3.3.0, y Apache Airflow antes de 2.7.0 están afectados por la vulnerabilidad Validation of OpenSSL Certificate. El contexto SSL por defecto con la librería SSL no comprobaba el certificado X.509 de un servidor.  En su lugar, el código aceptaba cualquier certificado, lo que podía dar lugar a la revelación de credenciales del servidor de correo o del contenido del correo cuando el cliente se conectaba a un atacante en posición MITM. Se recomienda encarecidamente a los usuarios que actualicen a Apache Airflow versión 2.7.0 o posterior, Apache Airflow IMAP Provider versión 3.3.0 o posterior y Apache Airflow SMTP Provider versión 1.3.0 o posterior para mitigar el riesgo asociado a esta vulnerabilidad.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.7.0\",\"matchCriteriaId\":\"4E21F5BA-D44C-4FE5-9211-E45B8BEE1DA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-imap:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"3.3.0\",\"matchCriteriaId\":\"E1601545-5019-45D5-A049-90ED0536E570\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-smtp:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.3.0\",\"matchCriteriaId\":\"97C37855-EE84-4FB9-8DD2-C2A702A0A5CD\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2023/08/23/2\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/apache/airflow/pull/33070\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apache/airflow/pull/33075\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apache/airflow/pull/33108\",\"source\":\"security@apache.org\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Patch\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2023/08/23/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/apache/airflow/pull/33070\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apache/airflow/pull/33075\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/apache/airflow/pull/33108\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Patch\",\"Vendor Advisory\"]}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/33075\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://github.com/apache/airflow/pull/33108\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://github.com/apache/airflow/pull/33070\", \"tags\": [\"patch\", \"x_transferred\"]}, {\"url\": \"https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb\", \"tags\": [\"vendor-advisory\", \"x_transferred\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2023/08/23/2\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T18:10:20.689Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-39441\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-27T20:31:29.615848Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-27T20:31:35.184Z\"}}], \"cna\": {\"title\": \"Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Martin Schobert, Pentagrid AG\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow SMTP Provider\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.30\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow IMAP Provider\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.3.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.7.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/33075\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/apache/airflow/pull/33108\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/apache/airflow/pull/33070\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2023/08/23/2\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and\\u00a0Apache Airflow before 2.7.0 are affected by the\\u00a0Validation of OpenSSL Certificate vulnerability.\\n\\nThe default SSL context with SSL library did not check a server's X.509\\u00a0certificate.\\u00a0 Instead, the code accepted any certificate, which could\\u00a0result in the disclosure of mail server credentials or mail contents\\u00a0when the client connects to an attacker in a MITM position.\\n\\nUsers are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"<span style=\\\"background-color: rgb(255, 255, 255);\\\">Apache Airflow SMTP Provider </span><span style=\\\"background-color: rgb(255, 255, 255);\\\">before 1.3.0</span><span style=\\\"background-color: rgb(255, 255, 255);\\\">, Apache Airflow IMAP Provider </span><span style=\\\"background-color: rgb(255, 255, 255);\\\">before 3.3.0, and</span><span style=\\\"background-color: rgb(255, 255, 255);\\\">&nbsp;Apache Airflow </span><span style=\\\"background-color: rgb(255, 255, 255);\\\">before 2.7.0 are affected by the&nbsp;</span>Validation of OpenSSL Certificate vulnerability.<br><br><span style=\\\"background-color: rgb(255, 255, 255);\\\">The default SSL context with SSL library did not check a server's X.509&nbsp;</span><span style=\\\"background-color: rgb(255, 255, 255);\\\">certificate.&nbsp; Instead, the code accepted any certificate, which could&nbsp;</span><span style=\\\"background-color: rgb(255, 255, 255);\\\">result in the disclosure of mail server credentials or mail contents&nbsp;</span><span style=\\\"background-color: rgb(255, 255, 255);\\\">when the client connects to an attacker in a MITM position.<br><br></span><span style=\\\"background-color: var(--wht);\\\">Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability</span>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"CWE-295 Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2023-08-23T15:40:07.139Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2023-39441\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T17:03:05.348Z\", \"dateReserved\": \"2023-08-02T12:26:27.028Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2023-08-23T15:39:51.632Z\", \"assignerShortName\": \"apache\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.