Mitigation Strategies

To mitigate this vulnerability, users are advised to upgrade to apache-airflow-providers-google version 22.0.0 or later.

Useful 0 Not Useful 0

Executive Summary

The vulnerability exists in Apache Airflow providers-google's ComputeEngineSSHHook, which disables SSH host-key verification by default.

This means that the SSH traffic between an Airflow worker and a Compute Engine virtual machine is not properly verified, allowing in-path network attackers to intercept or modify the SSH session.

Users are advised to upgrade to apache-airflow-providers-google version 22.0.0 or later to fix this issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers who are positioned between the Airflow worker and the Compute Engine VM to intercept or alter SSH traffic.

Such interception or modification could lead to unauthorized access, data tampering, or exposure of sensitive information during the SSH session.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, which exposes SSH traffic to interception or modification by in-path network attackers.

This exposure of potentially sensitive data in transit could lead to non-compliance with data protection standards and regulations such as GDPR and HIPAA, which require appropriate safeguards to protect data confidentiality and integrity.

Therefore, organizations using affected versions without upgrading may risk violating these regulations due to insufficient protection of data during transmission.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the Apache Airflow providers-google's ComputeEngineSSHHook using paramiko's AutoAddPolicy by default, which disables SSH host-key verification. To detect if your system is vulnerable, you need to check the version of the apache-airflow-providers-google package and inspect the configuration or code of ComputeEngineSSHHook to see if it uses the default host key policy.

• Check the installed version of apache-airflow-providers-google to ensure it is 22.0.0 or later: ```bash pip show apache-airflow-providers-google ```
• If you have access to the Airflow environment, inspect the code or configuration where ComputeEngineSSHHook is instantiated to see if the host_key_policy parameter is set. If it is not set or set to "auto_add", the system is vulnerable.
• To detect suspicious SSH traffic that might be intercepted or modified, you can monitor network traffic for unusual SSH handshake anomalies using tools like tcpdump or Wireshark, although this requires advanced network analysis.

Useful 0 Not Useful 0