-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPython| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| apache-airflow-providers-odbc | pip | < 4.0.0 | 4.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from how OdbcHook handled driver parameters before version 4.0.0. The driver property (in odbc.py) previously extracted driver values from connection extras without validation, as shown in the pre-patch code where it checked self.connection_extra_lower.get('driver'). This allowed malicious actors to specify dangerous driver paths through UI-editable connection configurations. The patch added 'allow_driver_extra' checks and warnings, confirming the pre-patch implementation was unsafe. The tests (test_odbc.py) demonstrate that driver extra was previously accepted by default, and the changelog explicitly states constructor enforcement as the mitigation.
Ongoing coverage of React2Shell