Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-39441

CVE-2023-39441:
Apache Airflow missing Certificate Validation

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-39441
GHSA ID
GHSA-5f35-pq34-c87q
EPSS Score
0.47329%
CWE
CWE-295
Published
8/23/2023
Updated
3/6/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
apache-airflow-providers-smtppip< 1.3.01.3.0
apache-airflow-providers-imappip< 3.3.03.3.0
apache-airflowpip< 2.7.02.7.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing SSL certificate validation in email client components. The commit diffs show:

  1. In IMAP hook, the _build_client function previously used IMAP4_SSL without SSL context parameters, defaulting to insecure behavior.
  2. In SMTP hook, the _build_client similarly lacked SSL context handling for SMTP_SSL connections.
  3. In Airflow core's email utils, _get_smtp_connection created SMTP_SSL connections without proper context configuration. The patches introduced SSL context selection (default/none) and validation logic to these exact functions, confirming they were the vulnerable points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*p**** *ir*low SMTP Provi**r ***or* *.*.*, *p**** *ir*low IM*P Provi**r ***or* *.*.*, *n* *p**** *ir*low ***or* *.*.* *r* *****t** *y t** V*li**tion o* Op*nSSL **rti*i**t* vuln*r**ility. T** ****ult SSL *ont*xt wit* SSL li*r*ry *i* not ****k * s*rv*

Reasoning

T** vuln*r**ility st*ms *rom missin* SSL **rti*i**t* v*li**tion in *m*il *li*nt *ompon*nts. T** *ommit *i**s s*ow: *. In IM*P *ook, t** _*uil*_*li*nt *un*tion pr*viously us** IM*P*_SSL wit*out SSL *ont*xt p*r*m*t*rs, ****ultin* to ins**ur* ****vior.