Advisoriesby IbisApache AirflowGHSA-92xg-gmrq-5c3w
Apache Airflow vulnerable to Execution with Unnecessary Privileges
Fix: upgrade to 2.10.1 or later
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author.
Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.10.1 | 2.10.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-250
- Also known as
- BIT-airflow-2024-45034, CVE-2024-45034, PYSEC-2024-212
- nvd.nist.gov/vuln/detail/CVE-2024-45034
- github.com/apache/airflow/pull/41672
- github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-212.yaml
- lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx
- www.openwall.com/lists/oss-security/2024/09/06/3
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Insertion of Sensitive Information Into Sent DataCVE-2024-50378fixed in 2.10.3Apache Airflow vulnerable to Improper Encoding or Escaping of OutputCVE-2024-45498fixed in 2.10.1Apache Airflow Cross-site Scripting VulnerabilityCVE-2024-41937fixed in 2.10.0Insufficient Session Expiration vulnerability in Apache Airflow Providers FABCVE-2024-42447no fix yetApache Airflow has DAG Author Code Execution possibility in airflow-schedulerCVE-2024-39877fixed in 2.9.3Apache Airflow Potential Cross-site Scripting VulnerabilityCVE-2024-39863fixed in 2.9.3