x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-51702

[GoVulnBot]

CVE-2023-51702 references github.com/apache/airflow, which may be a Go module.

Description:
Since version 5.2.0, when using deferrable mode with the path of a Kubernetes configuration file for authentication, the Airflow worker serializes this configuration file as a dictionary and sends it to the triggerer by storing it in metadata without any encryption. Additionally, if used with an Airflow version between 2.3.0 and 2.6.0, the configuration dictionary will be logged as plain text in the triggerer service without masking. This allows anyone with access to the metadata or triggerer log to obtain the configuration file and use it to access the Kubernetes cluster.

This behavior was changed in version 7.0.0, which stopped serializing the file contents and started providing the file path instead to read the contents into the trigger. Users are recommended to upgrade to version 7.0.0, which fixes this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-51702
• JSON: https://github.com/CVEProject/cvelist/tree/d60c28c8bf4b1e2c8335019d5146a570ea639d14/2023/51xxx/CVE-2023-51702.json
• fix: add missing read for K8S config file from conn in deferred KubernetesPodOperator  apache/airflow#29498
• fix: Avoid logging sensitive information in triggerer job log apache/airflow#30110
• fix: Support encryption for triggers parameters apache/airflow#36492
• web: https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9
• Imported by: https://pkg.go.dev/github.com/apache/airflow?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/apache/airflow
      vulnerable_at: 1.8.2
      packages:
        - package: Apache Airflow CNCF Kubernetes provider
cves:
    - CVE-2023-51702
references:
    - fix: https://github.com/apache/airflow/pull/29498
    - fix: https://github.com/apache/airflow/pull/30110
    - fix: https://github.com/apache/airflow/pull/36492
    - web: https://lists.apache.org/thread/89x3q6lz5pykrkr1fkr04k4rfn9pvnv9

[gopherbot]

Change https://go.dev/cl/557819 mentions this issue: data/excluded: batch add 10 excluded reports