GitHub Advisoryadvisory · PyPI

GHSA-92xg-gmrq-5c3w Apache Airflow vulnerable to Execution with Unnecessary Privileges

HIGH Published 2024-09-07 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-45034
Ecosystem
PyPI
Packages
apache-airflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-250
Reviewed
2024-09-09

Affected packages

• PyPI apache-airflow: < 2.10.1 → fixed in 2.10.1

Description

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-45034 Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it… vulnerability

Weakness · CWE (1)

  • CWE-250 Execution with Unnecessary Privileges weakness

References