Advisoriesby IbisApache AirflowGHSA-9g2w-5f3v-mfmm
Insecure default config of Celery worker in Apache Airflow
Fix: upgrade to 1.10.11 or later
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 1.10.11 | 1.10.11 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- BIT-airflow-2020-11982, CVE-2020-11982, PYSEC-2020-16
- nvd.nist.gov/vuln/detail/CVE-2020-11982
- github.com/apache/airflow/pull/13612
- github.com/apache/airflow/pull/7205
- github.com/advisories/GHSA-9g2w-5f3v-mfmm
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-16.yaml
- lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
More Apache Airflow advisories
All Apache Airflow
Apache Airflow logs passwords in plaintextCVE-2020-17511fixed in 1.10.13Stored XSS in Apache AirflowCVE-2020-9485fixed in 1.10.11Command injection via Celery broker in Apache AirflowCVE-2020-11981fixed in 1.10.11rc1Remote code execution (RCE) in Apache AirflowCVE-2020-11978fixed in 1.10.11rc1Multiple stored XSS in RBAC Admin screens in Apache AirflowCVE-2020-11983fixed in 1.10.11XSS in Apache AirflowCVE-2019-12398fixed in 1.10.5