Lucene search
GoogleOSV:BIT-AIRFLOW-2020-11982HistoryMar 06, 2024 - 11:01 a.m.
BIT-airflow-2020-11982
2024-03-0611:01:18
Google
osv.dev
4
apache airflow
celeryexecutor
vulnerability
remote code execution
deserialization attack
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Related
github
github
Insecure default config of Celery worker in Apache Airflow
2020-07-27 16:57:33
osv
osv
PYSEC-2020-16
2020-07-17 00:15:00
Insecure default config of Celery worker in Apache Airflow
2020-07-27 16:57:33
cvelist
cvelist
CVE-2020-11982
2020-07-16 23:21:25
prion
prion
Deserialization of untrusted data
2020-07-17 00:15:00
cve
cve
CVE-2020-11982
2020-07-17 00:15:00
nessus
nessus
Apache Airflow < 1.10.11 Multiple Vulnerabilities
2022-06-13 00:00:00
fortinet
fortinet
Multiple vulnerabilities in Apache Airflow
2022-06-07 00:00:00