GHSA-5hj9-m76g-xrc8

Source

https://github.com/advisories/GHSA-5hj9-m76g-xrc8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-5hj9-m76g-xrc8/GHSA-5hj9-m76g-xrc8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5hj9-m76g-xrc8

Aliases

Published

2023-09-14T09:30:28Z

Modified

2026-07-07T17:56:57Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Apache HDFS Provider error message suggested

Details

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

Database specific

{
    "cwe_ids":  [
        "CWE-829"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-03-01T21:29:25Z",
    "nvd_published_at":  "2023-09-14T08:15:07Z",
    "severity":  "HIGH"
}

References

Affected packages

PyPI / apache-airflow-providers-apache-hdfs

Package

Name: apache-airflow-providers-apache-hdfs; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow-providers-apache-hdfs

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.1.1

Affected versions

1.*

1.0.0b1

1.0.0b2

1.0.0rc1

1.0.0

1.0.1rc1

1.0.1

2.*

2.0.0rc1

2.0.0rc2

2.0.0

2.1.0rc1

2.1.0

2.1.1rc1

2.1.1

2.2.0rc1

2.2.0

2.2.1rc1

2.2.1

2.2.2rc1

2.2.2

2.2.3rc1

2.2.3

3.*

3.0.0rc1

3.0.0rc2

3.0.0

3.0.1rc1

3.0.1

3.1.0rc1

3.1.0rc2

3.1.0rc3

3.1.0

3.2.0rc1

3.2.0

3.2.1rc1

3.2.1

4.*

4.0.0rc1

4.0.0rc2

4.0.0

4.1.0rc1

4.1.0

4.1.1rc1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-5hj9-m76g-xrc8/GHSA-5hj9-m76g-xrc8.json"