Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

CVE-2023-37415

Summary

An improper input validation vulnerability exists in the Apache Airflow Apache Hive Provider prior to version 6.1.2, allowing user-controlled input to potentially inject unintended commands. Specifically, the proxy_user option is susceptible to injection of a semicolon, which can lead to further exploitation. It is critical for users to update to version 6.1.2 or later to mitigate this risk and maintain secure operations.

References