{"schema_version": "1.6.1", "id": "CVE-2023-33234", "summary": "KubernetesPodOperator RCE via connection configuration", "details": "Arbitrary code execution in Apache Airflow CNCF Kubernetes provider version 5.0.0 allows user to change xcom sidecar image and resources via Airflow connection.\n\nIn order to exploit this weakness, a user would already need elevated permissions (Op or Admin) to change the connection object in this manner.  Operators should upgrade to provider version 7.0.0 which has removed the vulnerability.\n\n", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "5.0.0"}, {"last_affected": "5.0.0"}]}]}], "references": [{"type": "WEB", "url": "https://lists.apache.org/thread/n1vpgl6h2qsdm52o9m2tx1oo86tl4gnq"}]}