[<prev] [next>] [day] [month] [year] [list]
Message-ID: <9c291caf-92b6-6293-193e-93ddc7fde95e@apache.org>
Date: Wed, 19 Jan 2022 14:08:03 +0000
From: Kaxil Naik <kaxilnaik@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-45230: Apache Airflow: Creating DagRuns didn't respect
Dag-level permissions in the Webserver
Description:
This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
This is a very low severity CVE and admins can mitigate this issue by removing the global "can_create" permissions on DagRun for Airflow versions >=2.0.0,<2.2.0 and 1.10.x versions that have set `rbac=True` in config.
Credit:
Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue.
References:
https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
