p PatchFirst

CVE-2024-29733

CVE-2024-29733 · Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.

CVSS 2.7 · Low · EPSS 0.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow ftp provider

    Versions
    • ≥ 0, < 3.7.0: Affected (semver)

    Update to 3.7.0

  • apache-airflow-providers-ftp PyPI

    Versions
    • 1.0.0
    • 1.0.0b1
    • 1.0.0b2
    • 1.0.0rc1
    • 1.0.1
    • 1.0.1rc1
    • 1.1.0
    • 1.1.0rc1
    • 2.0.0
    • 2.0.0rc1
    • 2.0.0rc2
    • 2.0.1
    • 2.0.1rc1
    • 2.1.0
    • 2.1.0rc1
    • 2.1.1
    • 2.1.1rc1
    • 2.1.2
    • 2.1.2rc1
    • 3.0.0
    • 3.0.0rc1
    • 3.0.0rc2
    • 3.1.0
    • 3.1.0rc1
    • 3.2.0
    • 3.2.0rc1
    • 3.3.0
    • 3.3.0rc1
    • 3.3.0rc2
    • 3.3.1
    • 3.3.1rc1
    • 3.4.0
    • 3.4.0rc1
    • 3.4.0rc2
    • 3.4.1
    • 3.4.1rc1
    • 3.4.2
    • 3.4.2rc1
    • 3.5.0
    • 3.5.0rc1
    • 3.5.1
    • 3.5.1rc1
    • 3.5.2
    • 3.5.2rc1
    • 3.6.0
    • 3.6.0rc1
    • 3.6.1
    • 3.6.1rc1
    • 3.7.0rc1
    Affected ranges
    • ECOSYSTEM: < 3.7.0

    Update to 3.7.0

Original sources

Check your server →