CVE-2023-41267— Apache HDFS Provider error message suggested installation of incorrect pip package

Apache HDFS Provider error message suggested installation of incorrect pip package

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

N/A

从非可信控制范围包含功能例程

Apache Airflow 安全漏洞

Apache Airflow是美国阿帕奇（Apache）基金会的一套用于创建、管理和监控工作流程的开源平台。该平台具有可扩展和动态监控等特点。 Apache Airflow HDFS Provider 4.1.1 之前版本存在安全漏洞，该漏洞源于文档信息指示用户安装了错误的 pip 软件包，该包名称无人认领，理论上，攻击者可以声明该包并提供安装该包时将执行代码。

N/A

N/A