Advisoriesby IbisApache AirflowGHSA-g5hv-r743-v8pm
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler
Fix: upgrade to 2.9.3 or later
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 2.4.0, < 2.9.3 | 2.9.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-277, CWE-94
- Also known as
- BIT-airflow-2024-39877, CVE-2024-39877, PYSEC-2024-190
- nvd.nist.gov/vuln/detail/CVE-2024-39877
- github.com/apache/airflow/pull/40522
- github.com/apache/airflow/commit/8159f6e24704f5e0e3b3217cf79ecf5083dce531
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-190.yaml
- lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1
- www.openwall.com/lists/oss-security/2024/07/16/7
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Improper Encoding or Escaping of OutputCVE-2024-45498fixed in 2.10.1Apache Airflow vulnerable to Execution with Unnecessary PrivilegesCVE-2024-45034fixed in 2.10.1Apache Airflow Cross-site Scripting VulnerabilityCVE-2024-41937fixed in 2.10.0Insufficient Session Expiration vulnerability in Apache Airflow Providers FABCVE-2024-42447no fix yetApache Airflow Potential Cross-site Scripting VulnerabilityCVE-2024-39863fixed in 2.9.3Apache Airflow does not return the "Cache-Control" header for dynamic contentCVE-2024-25142fixed in 2.9.2