PyPI/apache-airflow-providers-smtp CVE-2023-39441: medium 5.9, EPSS 0.80%

Apache Airflow missing Certificate Validation

Action: Upgrade apache-airflow-providers-smtp to 1.3.0 or later.

pip install apache-airflow-providers-smtp==1.3.0

Affected

Fixed versions

Sources

• osv: GHSA-5f35-pq34-c87q
• https://nvd.nist.gov/vuln/detail/CVE-2023-39441
• https://github.com/apache/airflow/pull/33070
• https://github.com/apache/airflow/pull/33075
• https://github.com/apache/airflow/pull/33108
• https://github.com/apache/airflow/commit/38fc9cd823feafd8ec61d5d5c7eddb9e9162f755
• https://github.com/apache/airflow/commit/3bd8f020e8b7bdeb7f618bdbdfb3557f117b29d3
• https://github.com/apache/airflow/commit/dbacacbd4d476da757de148a4e747924c34fd7fe
• https://github.com/apache/airflow
• https://lists.apache.org/thread/xzp4wgjg2b1o6ylk2595df8bstlbo1lb
• http://www.openwall.com/lists/oss-security/2023/08/23/2

CVE-2023-39441 · published 2023-08-23T18:30:34Z · modified 2026-07-13T16:42:58.247431314Z · JSON