Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <ac96fd18-bdb0-beef-cebf-c3506fa9458a@apache.org>
Date: Tue, 14 May 2024 10:15:17 +0000
From: Ephraim Anierobi <ephraimanierobi@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-32077: Apache Airflow: XSS vulnerability in Task Instance
 Log/Log Details 

Severity: moderate

Affected versions:

- Apache Airflow 2.9.0 before 2.9.1

Description:

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. 
Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Credit:

Ming (finder)
Jens Scheffler (remediation developer)

References:

https://github.com/apache/airflow/pull/38882
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-32077

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.