Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Software Foundation Apache Airflow ODBC Provider. In OdbcHook, A privilege escalation vulnerability exists in a system due to controllable ODBC driver parameters that allow the loading of arbitrary dynamic-link libraries, resulting in command execution. Starting version 4.0.0 driver can be set only from the hook constructor. This issue affects Apache Airflow ODBC Provider: before 4.0.0.
{ "nvd_published_at": "2023-06-27T12:15:13Z", "cwe_ids": [ "CWE-88" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2023-06-30T20:26:04Z" }