What’s Vulnerable › Vulnerabilities

CVE-2023-41267: Apache HDFS Provider error message suggested installation of incorrect pip package

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-14 · updated 2026-06-17
• Weakness: CWE-829

Description

In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

Affected products

• Apache Software Foundation Apache Airflow HDFS Provider: before 4.1.1 — fixed in 4.1.1

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Airflow HDFS Provider 4.1.1. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2023/09/14/3
• https://github.com/apache/airflow/pull/33813
• https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z
• http://www.openwall.com/lists/oss-security/2023/09/14/3
• https://github.com/apache/airflow/pull/33813
• https://lists.apache.org/thread/ggthr5pn42bn6wcr25hxnykjzh4ntw7z

Get alerted when CVE-2023-41267 or the next vulnerability affects your stack