Data Management and Analytics

In ‘bson’ module of MongoDB version 4.6.2 a medium severity vulnerability CVE-2024-5629 was detected. This vulnerability allows attackers to have an access to the application memory. There are no solutions for this yet. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-5629/.

In Apache Superset versions before 3.0.3 a medium severity vulnerability CVE-2023-49657 was detected. Attackers with permission to create or update charts or dashboards can insert harmful scripts or HTML snippets, enabling them to execute cross-site scripting attacks. To enhance security in 2.X versions, users need to update their configuration settings. For more information, visit https://avd.aquasec.com/nvd/2023/cve-2023-49657/.

In Apache Airflow versions before 2.8.2 vulnerability CVE-2024-26280 was detected. This issue allows certain users to see audit logs they shouldn’t. Starting from version 2.8.2, only admin users can view audit logs by default. Others need explicit permission. It’s advised to upgrade to version 2.8.2 or later to fix this problem. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-26280/.

In Graphite a critical severity vulnerability CVE-2023-34308 was detected. It enables remote code execution when users engage with harmful files or web pages. The software lacks proper checks on files like projects and source code, causing buffer overflow. For additional details, visit https://avd.aquasec.com/nvd/2023/cve-2023-34308.

In Apache Airflow versions 2.8.0 through 2.8.2 a high severity vulnerability CVE-2024-28746 was detected. It allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-28746/.

In Apache Airflow version 2.9.0 a critical security vulnerability CVE-2024-32077 was detected. This vulnerability allows attackers to inject data into the task instance logs. To address this issue, users are advised to upgrade to version 2.9.1. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-32077/.

In Fluent Bit versions 2.0.7 to 3.0.3 a critical security vulnerability CVE-2024-4323 was detected. This vulnerability allows attackers to parse trace requests and may result in remote code execution. There is no actual solution for this vulnerability. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-4323/.

In Apache Airflow FTP Provider versions before 3.7.0 a high severity vulnerability CVE-2024-29733 was detected. This problem involves incomplete checks on certificates during secure FTP connections, which could be exploited. To fix this, proper certificate validation should be implemented by updating to version 3.7.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-29733/.

In Airflow versions 2.7.0 through 2.8.4 a medium severity vulnerability CVE-2024-31869 was detected. A security flaw exposes sensitive provider configurations to authenticated users via the ‘configuration’ UI page when certain settings are configured, affecting mainly the Celery provider. Consider upgrading to Airflow version 2.9 or adjusting your expose_config setting to False as a temporary solution. For more information, visit https://avd.aquasec.com/nvd/2024/cve-2024-31869/.