Advisoriesby IbisApache AirflowGHSA-976r-qfjj-c24w
Command injection via Celery broker in Apache Airflow
Fix: upgrade to 1.10.11rc1 or later
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 1.10.11rc1 | 1.10.11rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-airflow-2020-11981, CVE-2020-11981, PYSEC-2020-15
- nvd.nist.gov/vuln/detail/CVE-2020-11981
- github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
- github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
- github.com/advisories/GHSA-976r-qfjj-c24w
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml
- lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
More Apache Airflow advisories
All Apache Airflow
Apache Airflow logs passwords in plaintextCVE-2020-17511fixed in 1.10.13Stored XSS in Apache AirflowCVE-2020-9485fixed in 1.10.11Insecure default config of Celery worker in Apache AirflowCVE-2020-11982fixed in 1.10.11Remote code execution (RCE) in Apache AirflowCVE-2020-11978fixed in 1.10.11rc1Multiple stored XSS in RBAC Admin screens in Apache AirflowCVE-2020-11983fixed in 1.10.11XSS in Apache AirflowCVE-2019-12398fixed in 1.10.5