GitHub Advisoryadvisory · PyPI

GHSA-g5hv-r743-v8pm Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler

HIGH Published 2024-07-17 Modified 2025-01-21 Official page ↗
Aliases
CVE-2024-39877
Ecosystem
PyPI
Packages
apache-airflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-277, CWE-94
Reviewed
2024-07-17

Affected packages

• PyPI apache-airflow: >= 2.4.0, < 2.9.3 → fixed in 2.9.3

Description

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

Related

Alias · CVE (1)

  • CVE-2024-39877 Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a… vulnerability

Weakness · CWE (2)

  • CWE-277 Insecure Inherited Permissions weakness
  • CWE-94 Improper Control of Generation of Code weakness

References