BIT-airflow-2024-45034

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/airflow/BIT-airflow-2024-45034.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-airflow-2024-45034
Aliases
Published
2024-09-10T07:04:17.732Z
Modified
2024-09-10T08:12:20.026833Z
Summary
[none]
Details

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

References

Affected packages

Bitnami / airflow

Package

Name
airflow
Purl
pkg:bitnami/airflow

Severity

  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.10.1