Apache Airflow SMTP Provider SmtpHook STARTTLS Certificate Validation Vulnerability

A vulnerability exists in Apache Airflow's SMTP provider, specifically in the SmtpHook component, versions 2.0.0 prior to 3.0.0. The issue arises because the SmtpHook calls Python's smtplib.SMTP.starttls() without an SSL context, leading to a lack of certificate validation during the TLS upgrade. This flaw allows a man-in-the-middle attacker to intercept the connection between the Airflow worker and the SMTP server, present a self-signed certificate, complete the STARTTLS upgrade, and capture SMTP credentials during the subsequent login() call.

Impact

Exploitation of this vulnerability could result in the interception of SMTP credentials by a man-in-the-middle attacker.

Remediation

Users are advised to upgrade to the version of apache-airflow-providers-smtp that includes the fix.