CVE-2022-38170 Overly permissive umask for daemons

2022-09-0207:10:21

apache

www.cve.org

cve-2022-38170

apache airflow

umask

race condition

world-writable files

local users

5 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

CNA Affected

[
  {
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.3.3",
        "status": "affected",
        "version": "Apache Airflow",
        "versionType": "custom"
      }
    ]
  }
]