Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

apache-airflow-providers-apache-hdfs

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.8PyPIAmendedPublished

    Apache HDFS Provider error message suggested

    CVE-2023-41267 · GHSA-5hj9-m76g-xrc8

    Affected
    • PyPI apache-airflow-providers-apache-hdfs < 4.1.1
    Fixed in
    4.1.1· Vendor fix available
    Issue
    In the Apache Airflow HDFS Provider, versions prior to 4.1.1, a documentation info pointed users to an install incorrect pip package. As this package name was unclaimed, in theory, an attacker could claim this package and provide code that would be executed when this package was installed. The Airflow team has since taken ownership of the package (neutralizing the risk), and fixed the doc strings in version 4.1.1

    Recommended action: Upgrade to 4.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →