CVE-2023-41267

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-829

Affected software

VendorProductVersions
Apache Software FoundationApache Airflow HDFS Provider< 4.1.1
apacheairflow_hdfs_provider< 4.1.1

References

Timeline

Published
Sep 14, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-412689.8Improper input validation vulnerability in Samsung Open Source Escargot allows stack overflow and segmentation fault. This issue affects EscCVE-2023-41275.9Race Condition within a Thread in GitHub repository answerdev/answer prior to v1.1.1.CVE-2023-412704.3Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before alCVE-2023-412737.2A heap-based buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabiliCVE-2023-412744.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabilityCVE-2023-412757.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412767.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412777.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412787.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412797.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412807.2A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited,CVE-2023-412817.2An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co
CVE-2023-41267: High severity, CVSS 7.8 | Vulnix