CVE-2020-11978

Apache Airflow CVE-2020-11978 affects Airflow 1.10.10 and earlier in one of the shipped example DAGs, enabling remote command execution. The root cause is a command-injection vulnerability in the example DAGs, which could allow an authenticated user to run arbitrary commands as the user running t...

PT-2020-6688 · Apache +2 · Apache Airflow +2

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 1.10.10 and below Description: The issue allows an attacker to inject commands if they can connect directly to the broker, such as Redis or RabbitMQ, when using CeleryExecutor. This can result in the celery worker...

PT-2020-6686 · Apache +2 · Apache Airflow +2

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 1.10.10 and below Description: The issue is related to the deserialization of untrusted data in Apache Airflow, which can lead to remote code execution. An attacker, acting remotely, can exploit this issue by inserting...

COVID-19 Risks of Flying

I fly a lot. Over the past five years, my average speed has been 32 miles an hour. That all changed mid-March. It's been 105 days since I've been on an airplane -- longer than any other time in my adult life -- and I have no future flights scheduled. This is all a prelude to saying that I have be...

airflow-util-dv (>=1.2.1 <=1.6.2), dbnd-examples (>=0.50.1 <=0.56.7) +2 more potentially affected by CVE-2020-11981 via apache-airflow (>=1.10.1 <=1.10.10)

apache-airflow PYPI version =1.10.1, =1.2.1, =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2020-11981 Source advisory: SNYK:PYTHON-APACHEAIRFLOW-570291...

Command Injection

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Command Injection. The celery executor gets plain commands to execute from the message broker, without any sanitization. An attacker can inject...

airflow-util-dv (>=1.2.1 <=1.6.2), dbnd-examples (>=0.50.1 <=0.56.7) +2 more potentially affected by CVE-2020-11982 via apache-airflow (>=1.10.1 <=1.10.10)

apache-airflow PYPI version =1.10.1, =1.2.1, =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2020-11982 Source advisory: SNYK:PYTHON-APACHEAIRFLOW-570290...

Insecure Default

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insecure Default. The celery broker acceptcontent setting was set to: 'json', 'pickle' by default, allowing deserialization of pickled messages,...

GHSA-RJVG-Q57V-MJJC XSS in Apache Airflow

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

XSS in Apache Airflow

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

CVE-2019-12398

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

CVE-2019-12398

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

PYSEC-2020-162

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

Code injection

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

PYSEC-2020-181

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

PYSEC-2020-162

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

CVE-2019-12398

Apache Airflow prior to 1.10.5 with the classic UI is affected. A malicious admin can modify object state in the Airflow metadata database to execute arbitrary JavaScript on certain page views (XSS). The RBAC UI is unaffected. Exploitation details and concrete fixes are not provided in the suppli...

CVE-2019-12398

In Apache Airflow before 1.10.5 when running with the "classic" UI, a malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. The new "RBAC" UI is unaffected...

datamorph-workflow-generator (=0.0.2), i2b2-import (>=0.0.1 <=1.5.34) +1 more potentially affected by CVE-2019-12417 via airflow (=0.6.0)

airflow PYPI version =0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on airflow and may be impacted: - datamorph-workflow-generator =0.0.2 - i2b2-import =0.0.1, =1.5.34 - pandasdb =0.0.10 Source cves: CVE-2019-12417 Source advisory:...

GHSA-Q3P4-GW7R-WQJC Apache Airflow vulnerable to XSS and local file disclosure

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process...