AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache AirflowGHSA-3v7g-4pg3-7r6j

OS Command injection in Apache Airflow

Apache Airflow

CVE-2022-24288 · Published Feb 26, 2022 · updated Sep 12, 2024

High8.8
Fix: upgrade to 2.2.4 or later
GitHub advisory

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
< 2.2.42.2.4
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-78
Also known as
BIT-airflow-2022-24288, CVE-2022-24288, PYSEC-2022-30

More Apache Airflow advisories

All Apache Airflow
Medium 4.7Sep 3, 2022Apache Airflow exposes arbitrary file contentCVE-2022-38170fixed in 2.3.4Critical 9.8May 24, 2022Missing Authentication for Critical Function in Apache AirflowCVE-2021-38540fixed in 2.1.3Medium 6.1May 14, 2022Apache Airflow Reflected Cross-site Scripting vulnerability in 404 EndpointCVE-2017-12614fixed in 1.9.0Medium 6.1Feb 26, 2022Apache Airflow Cross-site Scripting VulnerabilityCVE-2021-45229fixed in 2.2.4rc1Medium 6.5Jan 28, 2022Improper Privilege Management in apache-airflowCVE-2021-45230fixed in 2.2.0Medium 5.3Aug 30, 2021Missing Authorization in Apache AirflowCVE-2021-35936fixed in 2.1.2