AVID-2026-R1248

Description

Apache Airflow ODBC Provider: Remote code execution vulnerability (CVE-2023-34395)

Details

Improper Neutralization of Argument Delimiters in a Command (‘Argument Injection’) vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.

Reason for inclusion in AVID: The CVE describes a remote code execution vulnerability in Apache Airflow ODBC Provider, a software component commonly used in AI/ML data pipelines and orchestration. It affects a dependency used to build, deploy, or run AI systems (Airflow/OdbcHook), enabling arbitrary DLL loading and command execution. This is a security vulnerability affecting software supply chain elements (dependencies/orchestrators) used in general-purpose AI systems. Sufficient evidence is provided in the report: CVE description, CWE-88, affected version range, and references.

References

• NVD entry
• https://github.com/apache/airflow/pull/31713
• https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd

Affected or Relevant Artifacts

• Developer: Apache Software Foundation
• Deployer: Apache Software Foundation
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2023-06-27
• Version: 0.3.3
• AVID Entry