GHSA-c732-xvv8-g94c

Source

https://github.com/advisories/GHSA-c732-xvv8-g94c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/01/GHSA-c732-xvv8-g94c/GHSA-c732-xvv8-g94c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c732-xvv8-g94c

Aliases

Published

2023-01-21T15:30:18Z

Modified

2025-03-31T17:06:52.233353Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Command Injection in Apache Airflow and Apache Airflow MySQL Provider

Details

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Airflow MySQL Provider: before 4.0.0.

Database specific

{
    "severity": "CRITICAL",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-77"
    ],
    "nvd_published_at": "2023-01-21T14:15:00Z",
    "github_reviewed_at": "2023-01-23T20:42:27Z"
}

References

Affected packages

PyPI / apache-airflow

Package

Name: apache-airflow; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.5.1

Affected versions

1.*

1.8.1

1.8.2rc1

1.8.2

1.9.0

1.10.0

1.10.1b1

1.10.1rc2

1.10.1

1.10.2b2

1.10.2rc1

1.10.2rc2

1.10.2rc3

1.10.2

1.10.3b1

1.10.3b2

1.10.3rc1

1.10.3rc2

1.10.3

1.10.4b2

1.10.4rc1

1.10.4rc2

1.10.4rc3

1.10.4rc4

1.10.4rc5

1.10.4

1.10.5rc1

1.10.5

1.10.6rc1

1.10.6rc2

1.10.6

1.10.7rc1

1.10.7rc2

1.10.7rc3

1.10.7

1.10.8rc1

1.10.8

1.10.9rc1

1.10.9

1.10.10rc1

1.10.10rc2

1.10.10rc3

1.10.10rc4

1.10.10rc5

1.10.10

1.10.11rc1

1.10.11rc2

1.10.11

1.10.12rc1

1.10.12rc2

1.10.12rc3

1.10.12rc4

1.10.12

1.10.13rc1

1.10.13

1.10.14rc1

1.10.14rc2

1.10.14rc3

1.10.14rc4

1.10.14

1.10.15rc1

1.10.15

2.*

2.0.0b1

2.0.0b2

2.0.0b3

2.0.0rc1

2.0.0rc2

2.0.0rc3

2.0.0

2.0.1rc1

2.0.1rc2

2.0.1

2.0.2rc1

2.0.2

2.1.0rc1

2.1.0rc2

2.1.0

2.1.1rc1

2.1.1

2.1.2rc1

2.1.2

2.1.3rc1

2.1.3

2.1.4rc1

2.1.4rc2

2.1.4

2.2.0b1

2.2.0b2

2.2.0rc1

2.2.0

2.2.1rc1

2.2.1rc2

2.2.1

2.2.2rc1

2.2.2rc2

2.2.2

2.2.3rc1

2.2.3rc2

2.2.3

2.2.4rc1

2.2.4

2.2.5rc1

2.2.5rc2

2.2.5rc3

2.2.5

2.3.0b1

2.3.0rc1

2.3.0rc2

2.3.0

2.3.1rc1

2.3.1

2.3.2rc1

2.3.2rc2

2.3.2

2.3.3rc1

2.3.3rc2

2.3.3rc3

2.3.3

2.3.4rc1

2.3.4

2.4.0b1

2.4.0rc1

2.4.0

2.4.1rc1

2.4.1

2.4.2rc1

2.4.2

2.4.3rc1

2.4.3

2.5.0rc1

2.5.0rc2

2.5.0rc3

2.5.0

2.5.1rc1

2.5.1rc2

PyPI / apache-airflow-providers-mysql

Package

Name: apache-airflow-providers-mysql; View open source insights on deps.dev
Purl: pkg:pypi/apache-airflow-providers-mysql

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.0.0

Affected versions

1.*

1.0.0b1

1.0.0b2

1.0.0rc1

1.0.0

1.0.1rc1

1.0.1

1.0.2rc1

1.0.2

1.1.0rc1

1.1.0

2.*

2.0.0rc1

2.0.0rc2

2.0.0

2.1.0rc1

2.1.0rc2

2.1.0

2.1.1rc1

2.1.1

2.2.0rc1

2.2.0rc2

2.2.0

2.2.1rc1

2.2.1

2.2.2rc1

2.2.2

2.2.3rc1

2.2.3

3.*

3.0.0rc1

3.0.0rc2

3.0.0

3.1.0rc1

3.1.0

3.2.0rc1

3.2.0rc2

3.2.0rc3

3.2.0

3.2.1rc1

3.2.1

3.3.0rc1

3.3.0

3.4.0rc2

3.4.0rc3

3.4.0

4.*

4.0.0rc1