High · 8.8 CVE-2023-37415 EUVD-2023-1955GHSA-4q2q-q5pw-2342PYSEC-2026-1139

Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_user

Published Jul 13, 2023 · Updated Feb 13, 2025 · Assigned by apache

Description

Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Apache Hive Provider.

Patching on top of CVE-2023-35797
Before 6.1.2 the proxy_user option can also inject semicolon.

This issue affects Apache Airflow Apache Hive Provider: before 6.1.2.

It is recommended updating provider version to 6.1.2 in order to avoid this vulnerability.

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache Airflow Apache Hive Provider	< 6.1.2	6.1.2

Ecosystem	Package	Affected	Fixed	Record
PyPI	apache-airflow-providers-apache-hive	< 6.1.2	6.1.2	GHSA-4q2q-q5pw-2342