CVE-2024-29733

Improper Certificate Validation vulnerability in Apache Airflow FTP Provider. The FTP hook lacks complete certificate validation in FTP_TLS connections, which can potentially be leveraged. Implementing proper certificate validation by passing context=ssl.create_default_context() during FTP_TLS instantiation is used as mitigation to validate the certificates properly. This issue affects Apache Airflow FTP Provider: before 3.7.0. Users are recommended to upgrade to version 3.7.0, which fixes the issue.

• CWE-295

• http://www.openwall.com/lists/oss-security/2024/04/19/3Mailing List, Third Party Advisory
• https://docs.python.org/3/library/ssl.html#best-defaultsTechnical Description
• https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280Product
• https://github.com/apache/airflow/pull/38266Issue Tracking
• https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2024/04/19/3Mailing List, Third Party Advisory
• https://docs.python.org/3/library/ssl.html#best-defaultsTechnical Description
• https://github.com/apache/airflow/blob/95e26118b828c364755f3a8c96870f3591b01c31/airflow/providers/ftp/hooks/ftp.py#L280Product
• https://github.com/apache/airflow/pull/38266Issue Tracking
• https://lists.apache.org/thread/265t5zbmtjs6h9fkw52wtp03nsbplky2Mailing List, Vendor Advisory

Published

Apr 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29728SQL injection vulnerabilities in SportsNET affecting version…9.8
• CVE-2024-29729SQL injection vulnerabilities in SportsNET affecting version…9.8
• CVE-2024-2973An Authentication Bypass Using an Alternate Path or Channel …10
• CVE-2024-29730SQL injection vulnerabilities in SportsNET affecting version…9.8
• CVE-2024-29731SQL injection vulnerabilities in SportsNET affecting version…9.8
• CVE-2024-29732A SQL Injection has been found on SCAN_VISIO eDocument Suite…9.8
• CVE-2024-29734Uncontrolled search path element issue exists in SonicDICOM …7.8
• CVE-2024-29735Improper Preservation of Permissions vulnerability in Apache…5.3
• CVE-2024-29736A SSRF vulnerability in WADL service description in versions…9.1
• CVE-2024-29737In streampark, the project module integrates Maven's compila…4.7
• CVE-2024-29738In gov_init, there is a possible out of bounds read due to a…5.5
• CVE-2024-29739In tmu_get_temp_lut of tmu.c, there is a possible out of bou…5.5