Advisoriesby IbisApache AirflowGHSA-vm5m-qmrx-fw8w
Apache Airflow: Bypass permission verification to read code of other dags
Fix: upgrade to 2.8.1rc1 or later
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.8.1rc1 | 2.8.1rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-862
- Also known as
- BIT-airflow-2023-50944, CVE-2023-50944, PYSEC-2024-14
- nvd.nist.gov/vuln/detail/CVE-2023-50944
- github.com/apache/airflow/pull/36257
- github.com/apache/airflow/commit/8d76538d6e105947272b000581c6fabec20146b1
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-14.yaml
- lists.apache.org/thread/92krb5mpcq8qrw4t4j5oooqw7hgd8q7h
- www.openwall.com/lists/oss-security/2024/01/24/5
More Apache Airflow advisories
All Apache Airflow
Apache Airflow: pickle deserialization vulnerability in XComsCVE-2023-50943fixed in 2.8.1rc1Apache Airflow: cleartext storageCVE-2023-51702fixed in 2.6.1Apache Airflow Improper Access Control vulnerabilityCVE-2023-50783fixed in 2.8.0Apache Airflow Cross-Site Request Forgery vulnerabilityCVE-2023-49920fixed in 2.8.0Apache Airflow vulnerable to Exposure of Resource to Wrong SphereCVE-2023-48291fixed in 2.8.0Apache Airflow has a stored cross-site scripting vulnerabilityCVE-2023-47265fixed in 2.8.0b1