Apache AirflowGHSA-976r-qfjj-c24w
Command injection via Celery broker in Apache Airflow
Critical9.8CVE-2020-11981 · Published Jul 27, 2020 · updated Sep 11, 2024
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 1.10.11rc1 | 1.10.11rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-78
- Also known as
- BIT-airflow-2020-11981, CVE-2020-11981, PYSEC-2020-15
- nvd.nist.gov/vuln/detail/CVE-2020-11981
- github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
- github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
- github.com/advisories/GHSA-976r-qfjj-c24w
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml
- lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Dec 172020 | Apache Airflow logs passwords in plaintext Low2.8Dec 17, 2020 | Low2.8 | 1.10.13 |
| Jul 272020 | Stored XSS in Apache AirflowMedium6.1Jul 27, 2020 | Medium6.1 | 1.10.11 |
| Jul 272020 | Insecure default config of Celery worker in Apache AirflowCritical9.8Jul 27, 2020 | Critical9.8 | 1.10.11 |
| Jul 272020 | Remote code execution (RCE) in Apache AirflowHigh8.8Jul 27, 2020 | High8.8 | 1.10.11rc1 |
| Jul 272020 | Multiple stored XSS in RBAC Admin screens in Apache AirflowMedium5.4Jul 27, 2020 | Medium5.4 | 1.10.11 |
| May 62020 | XSS in Apache AirflowMedium4.8May 6, 2020 | Medium4.8 | 1.10.5 |