{"url":"http://public2.vulnerablecode.io/api/packages/659757?format=json","purl":"pkg:pypi/apache-airflow-providers-odbc@3.1.0rc1","type":"pypi","namespace":"","name":"apache-airflow-providers-odbc","version":"3.1.0rc1","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.0.0","latest_non_vulnerable_version":"4.0.0","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45499?format=json","vulnerability_id":"VCID-t2gs-qswp-z3bf","summary":"Improper Input Validation\nInput Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.This vulnerability is considered low since it requires DAG code to use `get_sqlalchemy_connection` and someone with access to connection resources specifically updating the connection to exploit it.\n\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0; Apache Airflow MSSQL Provider: before 3.4.1.\n\nIt is recommended to upgrade to a version that is not affected","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35798","reference_id":"","reference_type":"","scores":[{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33854","published_at":"2026-06-05T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33826","published_at":"2026-06-09T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33801","published_at":"2026-06-08T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33835","published_at":"2026-06-07T12:55:00Z"},{"value":"0.0014","scoring_system":"epss","scoring_elements":"0.33869","published_at":"2026-06-06T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-35798"},{"reference_url":"https://github.com/apache/airflow","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/airflow"},{"reference_url":"https://github.com/apache/airflow/commit/b6836986846058e9e5fa271fb7b22ae721020787","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/airflow/commit/b6836986846058e9e5fa271fb7b22ae721020787"},{"reference_url":"https://github.com/apache/airflow/pull/31984","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T18:24:53Z/"}],"url":"https://github.com/apache/airflow/pull/31984"},{"reference_url":"https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj","reference_id":"","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2024-10-07T18:24:53Z/"}],"url":"https://lists.apache.org/thread/951rb9m7wwox5p30tdvcfjxq8j1mp4pj"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35798","reference_id":"CVE-2023-35798","reference_type":"","scores":[{"value":"4.3","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},{"value":"MODERATE","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-35798"},{"reference_url":"https://github.com/advisories/GHSA-q57w-826p-46jr","reference_id":"GHSA-q57w-826p-46jr","reference_type":"","scores":[{"value":"MODERATE","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-q57w-826p-46jr"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65778?format=json","purl":"pkg:pypi/apache-airflow-providers-odbc@4.0.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/apache-airflow-providers-odbc@4.0.0"}],"aliases":["CVE-2023-35798","GHSA-q57w-826p-46jr"],"risk_score":3.1,"exploitability":"0.5","weighted_severity":"6.2","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-t2gs-qswp-z3bf"},{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/45506?format=json","vulnerability_id":"VCID-vg9b-yydh-uyca","summary":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider.\nIn OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution.\nStarting version 4.0.0 driver can be set only from the hook constructor.\nThis issue affects Apache Airflow ODBC Provider: before 4.0.0.","references":[{"reference_url":"https://api.first.org/data/v1/epss?cve=CVE-2023-34395","reference_id":"","reference_type":"","scores":[{"value":"0.00196","scoring_system":"epss","scoring_elements":"0.41381","published_at":"2026-06-08T12:55:00Z"},{"value":"0.00196","scoring_system":"epss","scoring_elements":"0.41412","published_at":"2026-06-07T12:55:00Z"},{"value":"0.00196","scoring_system":"epss","scoring_elements":"0.41441","published_at":"2026-06-06T12:55:00Z"},{"value":"0.00196","scoring_system":"epss","scoring_elements":"0.41391","published_at":"2026-06-09T12:55:00Z"},{"value":"0.00196","scoring_system":"epss","scoring_elements":"0.41437","published_at":"2026-06-05T12:55:00Z"}],"url":"https://api.first.org/data/v1/epss?cve=CVE-2023-34395"},{"reference_url":"https://github.com/apache/airflow","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/airflow"},{"reference_url":"https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://github.com/apache/airflow/commit/2844dad1c762f5c7dd1271866d3661bf66657300"},{"reference_url":"https://github.com/apache/airflow/pull/31713","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-07T18:23:00Z/"}],"url":"https://github.com/apache/airflow/pull/31713"},{"reference_url":"https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd","reference_id":"","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""},{"value":"Track","scoring_system":"ssvc","scoring_elements":"SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-10-07T18:23:00Z/"}],"url":"https://lists.apache.org/thread/l26yykftzbhc9tgcph8cso88bc2lqwwd"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34395","reference_id":"CVE-2023-34395","reference_type":"","scores":[{"value":"7.8","scoring_system":"cvssv3.1","scoring_elements":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},{"value":"HIGH","scoring_system":"generic_textual","scoring_elements":""}],"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34395"},{"reference_url":"https://github.com/advisories/GHSA-9766-v29c-4vm7","reference_id":"GHSA-9766-v29c-4vm7","reference_type":"","scores":[{"value":"HIGH","scoring_system":"cvssv3.1_qr","scoring_elements":""}],"url":"https://github.com/advisories/GHSA-9766-v29c-4vm7"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/65778?format=json","purl":"pkg:pypi/apache-airflow-providers-odbc@4.0.0","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/apache-airflow-providers-odbc@4.0.0"}],"aliases":["CVE-2023-34395","GHSA-9766-v29c-4vm7"],"risk_score":4.0,"exploitability":"0.5","weighted_severity":"8.0","resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-vg9b-yydh-uyca"}],"fixing_vulnerabilities":[],"risk_score":"4.0","resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/apache-airflow-providers-odbc@3.1.0rc1"}