[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ac96fd18-bdb0-beef-cebf-c3506fa9458a@apache.org>
Date: Tue, 14 May 2024 10:15:17 +0000
From: Ephraim Anierobi <ephraimanierobi@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance
Log/Log Details
Severity: moderate
Affected versions:
- Apache Airflow 2.9.0 before 2.9.1
Description:
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Users are recommended to upgrade to version 2.9.1, which fixes this issue.
Credit:
Ming (finder)
Jens Scheffler (remediation developer)
References:
https://github.com/apache/airflow/pull/38882
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-32077
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
