Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Internet Bug Bounty: CVE-2022-40127: RCE in Apache Airflow <2.4.0 bash example

airflow-2.3.3/airflow/exampledags/examplebashoperator.py has a command injection vulnerability. I can control the runid in the following codeexamplebashoperator.py,So I can inject custom commands. alsorunthis = BashOperator taskid='alsorunthis', bashcommand='echo "runid= runid | dagrun= dagrun "'...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-40127 Source advisory:...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aglow (>=0.1.0rc3, <=0.1.0rc4) +20 more potentially affected by CVE-2022-40127 via apache-airflow (>=2.0.0rc3, <=2.3.4)

apache-airflow PYPI version =2.0.0rc3, =0.8.44.4rc1, =0.1.0rc3, =0.2.9b1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.0.4rc1, =0.0.0, =0.1.0, =0.5.2, =0.8.3a1, =0.8.4b1 and more Source cves: CVE-2022-40127 Source advisory: OSV:GHSA-6PW3-8H9W-32GC...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2022-40127 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2022-40127 Source advisory: OSV:GHSA-6PW3-8H9W-32GC...

data-tracking (1.7.3) potentially affected by CVE-2022-40127 via apache-airflow (1.9.0)

apache-airflow PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - data-tracking 1.7.3 Source cves: CVE-2022-40127 Source advisory: OSV:GHSA-6PW3-8H9W-32GC...

airflow-util-dv (>=1.2.1, <=1.6.2) potentially affected by CVE-2022-40127 via apache-airflow (1.10.1)

apache-airflow PYPI version 1.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-util-dv =1.2.1, =1.6.2 Source cves: CVE-2022-40127 Source advisory: OSV:GHSA-6PW3-8H9W-32GC...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2022-40127 Source advisory:...

airflow-clickhouse-plugin (>=0.5.1, <=0.5.3), dbnd-airflow (0.24.11) +1 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.6)

apache-airflow PYPI version 1.10.6 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.5.1, =0.5.3 - dbnd-airflow 0.24.11 - dbnd-airflow-versioned-dag 0.24.11 Source cves: CVE-2022-40127...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2022-40127 Source advisory: OSV:GHSA-6PW3-8H9W-32GC...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +83 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

CVE-2022-40127

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

acryl-datahub-airflow-plugin (>=0.8.44.4rc1, <=0.9.2.1), aglow (>=0.1.0rc3, <=0.1.0rc4) +20 more potentially affected by CVE-2022-40127 via apache-airflow (>=2.0.0rc3, <=2.3.4)

apache-airflow PYPI version =2.0.0rc3, =0.8.44.4rc1, =0.1.0rc3, =0.2.9b1, =0.6.0, =0.2.0, =0.0.3, =0.0.6, =0.0.1, =0.0.4rc1, =0.0.0, =0.1.0, =0.5.2, =0.8.3a1, =0.8.4b1 and more Source cves: CVE-2022-40127 Source advisory: OSV:PYSEC-2022-42982...

airflow-docker (>=0.1.1, <=0.5.0), airflow-indexima (>=1.0.1, <=2.2.1) +5 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.2)

apache-airflow PYPI version 1.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =0.1.1, =1.0.1, =0.4.0rc2, =0.1.0, =3.0.0, =0.0.12, =1.0.1 Source cves: CVE-2022-40127 Source advisory:...

dbnd-examples (>=0.50.1, <=0.56.7), earnest-airflow-plugin (>=0.0.1, <=0.0.2b1) +1 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.10)

apache-airflow PYPI version 1.10.10 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-examples =0.50.1, =0.0.1, =10.3.0rc1, =10.3.0rc2 Source cves: CVE-2022-40127 Source advisory: OSV:PYSEC-2022-42982...

dbnd-airflow (>=0.24.14, <=0.25.15), dbnd-airflow-versioned-dag (>=0.24.14, <=0.25.15) +2 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.7)

apache-airflow PYPI version 1.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dbnd-airflow =0.24.14, =0.24.14, =0.24.14, =0.24.14, =0.25.7 Source cves: CVE-2022-40127 Source advisory: OSV:PYSEC-2022-42982...

airflow-docker (>=1.0.0, <=1.1.0) potentially affected by CVE-2022-40127 via apache-airflow (1.10.5)

apache-airflow PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-docker =1.0.0, =1.1.0 Source cves: CVE-2022-40127 Source advisory: OSV:PYSEC-2022-42982...

airflow-aggua-plugin (>=1.0.7, <=1.0.8), airflow-clickhouse-plugin (>=0.5.6, <=0.5.7.post1) +83 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.15)

apache-airflow PYPI version 1.10.15 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-aggua-plugin =1.0.7, =0.5.6, =0.1.0, =0.0.7, =0.0.1, =0.1.6, =0.0.2, =1.0.0, =2020.5.20rc1, =2021.2.5rc1, =2020.5.20rc1,...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-40127 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-40127 Source advisory:...