[<prev] [next>] [day] [month] [year] [list]
Message-ID: <867990f8-9e5c-a0aa-d56c-3ece9e96192c@apache.org>
Date: Tue, 16 Jul 2024 12:08:54 +0000
From: Ephraim Anierobi <ephraimanierobi@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-39877: Apache Airflow: DAG Author Code Execution
possibility in airflow-scheduler
Severity: important
Affected versions:
- Apache Airflow 2.4.0 before 2.9.3
Description:
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.
Credit:
Seokchan Yoon (https://github.com/ch4n3-yoon) (finder)
Wei Lee (remediation developer)
References:
https://github.com/apache/airflow/pull/40522
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-39877
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
