Mongo Hook Fixes Unexpected SSL Validation Issue
CVE-2024-25141
9.1CRITICAL
Key Information:
- Vendor
Apache
- Vendor
- CVE Published:
- 20 February 2024
What is CVE-2024-25141?
A security vulnerability has been identified in Apache Airflow's Mongo Hook when SSL is enabled. The default settings included 'allow_insecure', which unintentionally permitted the acceptance of unvalidated SSL certificates. This configuration oversight was not documented, exposing users to potential security risks. It is strongly advised that users upgrade to version 4.0.0, which rectifies this issue by enforcing proper SSL certificate validation to enhance security.
Affected Version(s)
Apache Airflow Mongo Provider 1.0.0 < 4.0.0