The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was transmitted in cleartext. Any deployment using `FTPSHook` or `FTPSFileTransmitOperator` to move files over FTPS exposed file contents and credentials-in-transit to a network attacker able to observe the data connection. Upgrade apache-airflow-providers-ftp to `3.15.1` or later, which issues `PROT P` to encrypt the data channel.
| Vendor | Product | Versions |
|---|---|---|
| apache | apache-airflow-providers-ftp | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| apache | airflow | cert_advisory | 90% |
Updated severity from HIGH to MEDIUM and marked exploit as available and actively exploited.
Updated description with new details, changed severity to HIGH, and noted that no exploit exists.
Initial creation
