Internet Bug Bounty: CVE-2022-24288: Apache Airflow: TWO RCEs in example DAGs

In Apache Airflow, prior to version 2.2.4, In DAG script of airflow , there is two command injection vulnerability RCE in the some scripts, which an attacker can execute arbitrary commands on the system. The impact is even greater when airflow is configured for unauthenticated access. These two...

GHSA-3V7G-4PG3-7R6J OS Command injection in Apache Airflow

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-24288 Source advisory:...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2022-24288 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2022-24288 Source advisory:...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2021-45229 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2021-45229 Source advisory:...

PYSEC-2022-30

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...

CVE-2022-24288

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...

CVE-2022-24288 Apache Airflow: RCE in example DAGs

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...

Apache Airflow operating system command injection vulnerability

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. Apache Airflow suffers from an operating system command injection vulnerability tha...

CVE-2022-24288: Improper Neutralization of Special Elements used in an OS Command

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...

org.apache.camel:camel-example-cxf (>=2.9.4, <=2.9.5), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.6) +11 more potentially affected by CVE-2020-1954 via org.apache.cxf:cxf-rt-management (2.5.6)

org.apache.cxf:cxf-rt-management MAVEN version 2.5.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-management and may be impacted: - org.apache.camel:camel-example-cxf =2.9.4, =2.9.5 - org.apache.cxf.systests:cxf-systests-jaxrs...

org.apache.camel:camel-example-cxf (>=1.6.4, <=2.4.0), org.apache.cxf.systests:cxf-systests-jaxrs (2.2.9) +6 more potentially affected by CVE-2020-1954 via org.apache.cxf:cxf-rt-management (2.2.9)

org.apache.cxf:cxf-rt-management MAVEN version 2.2.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-management and may be impacted: - org.apache.camel:camel-example-cxf =1.6.4, =2.4.0 - org.apache.cxf.systests:cxf-systests-jaxrs...

org.apache.camel:camel-cxf (1.5.0), org.apache.camel:camel-example-cxf (1.5.0) +4 more potentially affected by CVE-2020-1954 via org.apache.cxf:cxf-rt-management (2.1.3)

org.apache.cxf:cxf-rt-management MAVEN version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-management and may be impacted: - org.apache.camel:camel-cxf 1.5.0 - org.apache.camel:camel-example-cxf 1.5.0 -...

org.apache.camel:camel-example-cxf (>=2.9.6, <=2.9.8), org.apache.cxf.systests:cxf-systests-jaxrs (2.5.9) +11 more potentially affected by CVE-2020-1954 via org.apache.cxf:cxf-rt-management (2.5.9)

org.apache.cxf:cxf-rt-management MAVEN version 2.5.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-management and may be impacted: - org.apache.camel:camel-example-cxf =2.9.6, =2.9.8 - org.apache.cxf.systests:cxf-systests-jaxrs...

org.apache.camel:camel-example-cxf (>=2.8.4, <=2.8.5), org.apache.cxf.systests:cxf-systests-jaxrs (2.4.6) +11 more potentially affected by CVE-2020-1954 via org.apache.cxf:cxf-rt-management (2.4.6)

org.apache.cxf:cxf-rt-management MAVEN version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-management and may be impacted: - org.apache.camel:camel-example-cxf =2.8.4, =4.4.1, =4.4.1, =4.4.2 Source cves: CVE-2020-1954...

org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m4), org.eclipse.hono:hono-adapter-rest-vertx (0.5-m4) +4 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m4)

org.eclipse.hono:hono-core MAVEN version 0.5-m4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m4 - org.eclipse.hono:hono-adapter-rest-vertx 0.5-m4 -...

org.eclipse.hono:hono-adapter-http-vertx-base (0.5-m5), org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m5) +5 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m5)

org.eclipse.hono:hono-core MAVEN version 0.5-m5 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-http-vertx-base 0.5-m5 - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m5 -...

org.eclipse.hono:hono-adapter-mqtt-vertx (0.5-m2), org.eclipse.hono:hono-adapter-rest-vertx (0.5-m2) +4 more potentially affected by CVE-2020-27217 via org.eclipse.hono:hono-core (0.5-m2)

org.eclipse.hono:hono-core MAVEN version 0.5-m2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.hono:hono-core and may be impacted: - org.eclipse.hono:hono-adapter-mqtt-vertx 0.5-m2 - org.eclipse.hono:hono-adapter-rest-vertx 0.5-m2 -...

com.bardframework:bard-example (>=0.1.0, <=0.1.1), com.bardframework:bard-simple (>=0.1.0, <=0.1.1) +145 more potentially affected by CVE-2020-25638 via org.hibernate:hibernate-core (4.3.6.final)

org.hibernate:hibernate-core MAVEN version 4.3.6.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-core and may be impacted: - com.bardframework:bard-example =0.1.0, =0.1.0, =0.1.0, =1.0.15-release, =1.0.15-release,...

net.liftweb:lift-example (>=1.0, <=1.1-m7) potentially affected by CVE-2022-23221 via com.h2database:h2 (1.0.79)

com.h2database:h2 MAVEN version 1.0.79 is affected by a known vulnerability. The following packages have a transitive dependency on com.h2database:h2 and may be impacted: - net.liftweb:lift-example =1.0, =1.1-m7 Source cves: CVE-2022-23221 Source advisory: OSV:GHSA-45HX-WFHJ-473X...