CVE-2023-39441

CVE-2023-39441 is a vulnerability affecting Apache Airflow, its SMTP Provider, and IMAP Provider, where the default SSL context failed to validate server X.509 certificates. This flaw, rated Medium severity (CVSS 5.9), could allow an attacker in a Man-in-the-Middle (MITM) position to intercept and disclose mail server credentials or mail contents due to the lack of certificate verification. While the vulnerability is remotely exploitable with high attack complexity, there is currently no evidence of active exploitation, public exploit code, or significant community discussion. Users are advised to upgrade to Apache Airflow 2.7.0+, IMAP Provider 3.3.0+, and SMTP Provider 1.3.0+ to remediate.