CVE-2024-25141 - Vulnerability Details - OpenCVE

When ssl was enabled for Mongo Hook, default settings included "allow_insecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Apache	Airflow Mongo Provider

No data.

No data.

References

Link	Providers
http://www.openwall.com/lists/oss-security/2024/02/20/5
https://github.com/apache/airflow/pull/37214
https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm

History

Thu, 13 Feb 2025 18:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Apache Apache airflow Mongo Provider
CPEs		cpe:2.3:a:apache:airflow_mongo_provider::::::::
Vendors & Products		Apache Apache airflow Mongo Provider
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 13 Feb 2025 17:45:00 +0000

Type	Values Removed	Values Added
Title	Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo	Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

Thu, 15 Aug 2024 21:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2024-02-20T20:30:28.924Z

Updated: 2025-02-13T17:40:48.227Z

Reserved: 2024-02-06T09:03:40.736Z

Link: CVE-2024-25141

Vulnrichment

Updated: 2024-08-01T23:36:21.630Z

NVD

Status : Awaiting Analysis

Published: 2024-02-20T21:15:08.267

Modified: 2024-11-21T09:00:20.073

Link: CVE-2024-25141

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-25141", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-02-06T09:03:40.736Z", "datePublished": "2024-02-20T20:30:28.924Z", "dateUpdated": "2025-02-13T17:40:48.227Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected", "packageName": "apache-airflow-providers-mongo", "product": "Apache Airflow Mongo Provider", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "4.0.0", "status": "affected", "version": "1.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "Noah Stapp"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When </span><code>ssl</code><span style=\"background-color: rgb(255, 255, 255);\"> was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.</span><br>Users are recommended to upgrade to version 4.0.0, which fixes this issue."}], "value": "When ssl\u00a0was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.\nUsers are recommended to upgrade to version 4.0.0, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-20T20:35:06.778Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/37214"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/20/5"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.630Z"}, "title": "CVE Program Container", "references": [{"tags": ["patch", "x_transferred"], "url": "https://github.com/apache/airflow/pull/37214"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm"}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/20/5", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "apache", "product": "airflow_mongo_provider", "cpes": ["cpe:2.3:a:apache:airflow_mongo_provider:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-15T19:28:23.619747Z", "id": "CVE-2024-25141", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:31:04.235Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/apache/airflow/pull/37214", "tags": ["patch", "x_transferred"]}, {"url": "https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/20/5", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:36:21.630Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-25141", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-15T19:28:23.619747Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:airflow_mongo_provider:*:*:*:*:*:*:*:*"], "vendor": "apache", "product": "airflow_mongo_provider", "versions": [{"status": "affected", "version": "0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-15T19:30:55.473Z"}}], "cna": {"title": "Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "reporter", "value": "Noah Stapp"}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow Mongo Provider", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.0.0", "versionType": "semver"}], "packageName": "apache-airflow-providers-mongo", "collectionURL": "https://pypi.python.org", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/37214", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/sqgbfqngjmn45ommmrgj7hvs7fgspsgm", "tags": ["vendor-advisory"]}, {"url": "http://www.openwall.com/lists/oss-security/2024/02/20/5"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "When ssl\u00a0was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.\nUsers are recommended to upgrade to version 4.0.0, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">When </span><code>ssl</code><span style=\"background-color: rgb(255, 255, 255);\"> was enabled for Mongo Hook, default settings included \"allow_insecure\" which caused that certificates were not validated. This was unexpected and undocumented.</span><br>Users are recommended to upgrade to version 4.0.0, which fixes this issue.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper Certificate Validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-02-20T20:35:06.778Z"}}}, "cveMetadata": {"cveId": "CVE-2024-25141", "state": "PUBLISHED", "dateUpdated": "2025-02-13T17:40:48.227Z", "dateReserved": "2024-02-06T09:03:40.736Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-02-20T20:30:28.924Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}