CVE-2023-39441 json
Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation
published 2023-08-23 3 y ago modified 2026-09-08 2 mo ago also BIT-airflow-2023-39441 , EUVD-2023-2213 , GHSA-5f35-pq34-c87q , PYSEC-2026-1130 , PYSEC-2026-2368 , PYSEC-2026-2371
- cvss
- 5.9
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 56%
- public exploits
- 0
- none known
Summary
Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.
The default SSL context with SSL library did not check a server's X.509 certificate. Instead, the code accepted any certificate, which could result in the disclosure of mail server credentials or mail contents when the client connects to an attacker in a MITM position.
Users are strongly advised to upgrade to Apache Airflow version 2.7.0 or newer, Apache Airflow IMAP Provider version 3.3.0 or newer, and Apache Airflow SMTP Provider version 1.3.0 or newer to mitigate the risk associated with this vulnerability
Patch / fix
- pypi apache-airflow-providers-smtp 1.3.0
- pypi apache-airflow-providers-imap 3.3.0
- pypi apache-airflow 2.7.0
- bitnami airflow 2.7.0
- Apache Software Foundation Apache Airflow SMTP Provider 1.30
- Apache Software Foundation Apache Airflow IMAP Provider 3.3.0
- Apache Software Foundation Apache Airflow 2.7.0
- github.com/apache/airflow@38fc9cd commit
- github.com/apache/airflow@3bd8f02 commit
- github.com/apache/airflow@dbacacb commit
- github.com/apache/airflow#33075 pull request
- github.com/apache/airflow#33108 pull request
- github.com/apache/airflow#33070 pull request
- lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb advisory
- openwall.com/lists/oss-security/2023/08/23/2 advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.80% chance of exploitation in the next 30 days, higher than 56% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
| OSV | 3.1 | 5.9 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-airflow-providers-smtp | <1.3.0 |
1.3.0 |
| pypi | apache-airflow-providers-imap | <3.3.0 |
3.3.0 |
| pypi | apache-airflow | <2.7.0 |
2.7.0 |
| bitnami | airflow | <2.7.0 |
2.7.0 |
Affected products
- Apache Software Foundation Apache Airflow SMTP Provider
- Apache Software Foundation Apache Airflow IMAP Provider
- Apache Software Foundation Apache Airflow
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/apache/airflow/pull/33075
patch, web
-
github.com
/apache/airflow/pull/33108
patch, web
-
github.com
/apache/airflow/pull/33070
patch, web
-
lists.apache.org
/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb
vendor-advisory, web, mailing-list, patch, advisory
-
openwall.com
/lists/oss-security/2023/08/23/2
web, mailing-list, patch, third-party-advisory, advisory
-
github.com
/apache/airflow/commit/38fc9cd823feafd8ec61d5d5c7eddb9e9162f755
web
-
github.com
/apache/airflow/commit/3bd8f020e8b7bdeb7f618bdbdfb3557f117b29d3
web
-
github.com
/apache/airflow/commit/dbacacbd4d476da757de148a4e747924c34fd7fe
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-39441
advisory, web
-
github.com
/apache/airflow
package
-
pypi.org
/project/apache-airflow
package
-
github.com
/advisories/GHSA-5f35-pq34-c87q
advisory
-
pypi.org
/project/apache-airflow-providers-imap
package
-
pypi.org
/project/apache-airflow-providers-smtp
package
Sources
- CVE List CVE-2023-39441
- GitHub Advisory GHSA-5f35-pq34-c87q
- NVD CVE-2023-39441
- OSV BIT-airflow-2023-39441
- OSV PYSEC-2026-1130
- OSV PYSEC-2026-2368
- OSV PYSEC-2026-2371
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.