CVE-2024-29733CWE-295

Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context

Low · published April 21, 2024

CVSS v3.1
2.7
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider.

The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly.

This issue affects Apache Airflow FTP Provider: before 3.7.0.

Users are recommended to upgrade to version 3.7.0, which fixes the issue.

The record
Technical detail
CVSS v3.1
2.7 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00631 · 49.6th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2024-04-21T17:21Z
EPSS history
Timeline
  • 21 APR 17:21Z
    Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context
    cvelistv5