GHSA-746V-HFH2-XPHM Remote code execution in Apache Airflow Docker's Provider

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above...

Internet Bug Bounty: CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host. Vulnerability summary: In DAG script of airflow 2.3.3, there is a command injection vulnerability RCE in the script exampledockercopydata.py of...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

Design/Logic Flaw

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362 Docker Provider <3.0 RCE vulnerability in example dag

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to authenticated remote code exploit of code on the Airflow worker host...

CVE-2022-38362

CVE-2022-38362 affects the Apache Airflow Docker provider prior to 3.0.0. The issue stems from an example DAG shipped with the provider and is exploitable via authenticated remote code execution on the Airflow worker host, involving a BashOperator call and a template-controlled parameter (source_...

PT-2022-24388

Name of the Vulnerable Software and Affected Versions Apache Airflow Docker's Provider versions prior to 3.0.0 Description The issue is related to an example DAG in Apache Airflow Docker's Provider that is vulnerable to authenticated remote code exploit on the Airflow worker host. Recommendations...

Apache Airflow 安全漏洞

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. The platform is scalable and dynamically monitored, etc. A remote code execution vulnerability exists in versions of Apache Airflow prior to 3.0.0. The vulnerability stems from th...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary commands.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of protective measures taken for the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The default installation configuration “[webserver] secret_key” of the Airflow data processing software’s creation, monitoring, and orchestration tools makes it possible for a malicious individual to gain unauthorized access to an external web server.

The vulnerability of the default installation configuration “webserver secretkey” in software for creating, monitoring, and orchestrating Airflow data processing scenarios is related to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker, operating remotely...

The vulnerability of the software responsible for creating, monitoring, and orchestrating data processing scripts in Airflow lies in its ability to restore unreliable data structures in memory, allowing an attacker to execute arbitrary code or cause service failures.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or cause service failures...

Exploit for Missing Authentication for Critical Function in Apache Airflow

CVE-2021-38540 Proof of Concept Missing Authentication on Crit...

Apache Airflow < 1.10.11 Multiple Vulnerabilities

The version of Apache Airflow is prior to 1.10.11. It is, therefore, affected by multiple vulnerabilities, including the following: - An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker Redis, RabbitMQ directly, it i...

Multiple vulnerabilities in Apache Airflow

Security advisories were released affecting the version of Apache Airflow library used in some Fortinet products:...

Missing Authentication for Critical Function in Apache Airflow

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

GHSA-H88F-R7CW-8FV3 Missing Authentication for Critical Function in Apache Airflow

The variable import endpoint was not protected by authentication in Airflow =2.0.0, =2.0.0, 2.1.3...

GHSA-RV25-9WGJ-XG75 Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. However Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrad...

Apache Airflow Reflected Cross-site Scripting vulnerability in 404 Endpoint

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. However Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrad...