Apache Airflow OS Command Injection

Apache Airflow prior to version 2.2.4 is vulnerable to OS command injection attacks because some example DAGs do not properly sanitize user-provided parameters, making them susceptible to OS Command Injection from the web UI. id: CVE-2022-24288 info: name: Apache Airflow OS Command Injection...

Apache Airflow Command Injection (CVE-2022-24288)

A command injection vulnerability exists in Apache Airflow. This vulnerability is due to improper input validation for parameters for directed acyclic graphs DAGs...

Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs

In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +8 more potentially affected by CVE-2022-24288 via apache-airflow (>=2.0.0rc3, <=2.1.2)

apache-airflow PYPI version =2.0.0rc3, =0.1.0rc3, =0.0.4rc1, =0.0.0, =0.3.12, =11.8.0, =14.7.0 - gps-building-blocks 1.2.2 - neuro-airflow-plugin 0.0.1 - viewflow 0.1.0 Source cves: CVE-2022-24288 Source advisory: GHSA-3V7G-4PG3-7R6J...

contra-rotor (0.1.0), etl-server (>=0.0.6, <=0.0.7) potentially affected by CVE-2022-24288 via apache-airflow (1.10.13)

apache-airflow PYPI version 1.10.13 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - contra-rotor 0.1.0 - etl-server =0.0.6, =0.0.7 Source cves: CVE-2022-24288 Source advisory: OSV:GHSA-3V7G-4PG3-7R6J...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +83 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +8 more potentially affected by CVE-2022-24288 via apache-airflow (>=2.0.0rc3, <=2.1.2)

apache-airflow PYPI version =2.0.0rc3, =0.1.0rc3, =0.0.4rc1, =0.0.0, =0.3.12, =11.8.0, =14.7.0 - gps-building-blocks 1.2.2 - neuro-airflow-plugin 0.0.1 - viewflow 0.1.0 Source cves: CVE-2022-24288 Source advisory: OSV:GHSA-3V7G-4PG3-7R6J...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2022-24288 Source advisory: OSV:GHSA-3V7G-4PG3-7R6J...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2022-24288 Source advisory:...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2022-24288 Source advisory: OSV:GHSA-3V7G-4PG3-7R6J...

gps-building-blocks (>=1.2.3, <=1.25.0) potentially affected by CVE-2022-24288 via apache-airflow (1.10.14)

apache-airflow PYPI version 1.10.14 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - gps-building-blocks =1.2.3, =1.25.0 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2022-24288...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2022-24288 Source advisory:...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...

airflow-util-dv (>=1.2.1, <=1.6.2) potentially affected by CVE-2022-24288 via apache-airflow (1.10.1)

apache-airflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-util-dv =1.2.1, =1.6.2 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-24288 Source advisory:...

contra-rotor (0.1.0), etl-server (>=0.0.6, <=0.0.7) potentially affected by CVE-2022-24288 via apache-airflow (1.10.13)

apache-airflow PYPI version 1.10.13 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - contra-rotor 0.1.0 - etl-server =0.0.6, =0.0.7 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +83 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

dag-manager (>=0.1.3a0, <=0.1.5a0), dagster-airflow (>=0.5.4rc0, <=0.5.4) +2 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.3)

apache-airflow PYPI version 1.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dag-manager =0.1.3a0, =0.5.4rc0, =0.1.0, =3.0.2, =3.0.3 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...

aglow (>=0.1.0rc3, <=0.1.0rc4), ai-flow (0.3.1) +8 more potentially affected by CVE-2022-24288 via apache-airflow (>=2.0.0rc3, <=2.1.2)

apache-airflow PYPI version =2.0.0rc3, =0.1.0rc3, =0.0.4rc1, =0.0.0, =0.3.12, =11.8.0, =14.7.0 - gps-building-blocks 1.2.2 - neuro-airflow-plugin 0.0.1 - viewflow 0.1.0 Source cves: CVE-2022-24288 Source advisory: OSV:PYSEC-2022-30...