PT-2025-51355

Name of the Vulnerable Software and Affected Versions Fickling versions prior to 0.1.6 Description Fickling, a Python pickling decompiler and static analyzer, contained a bypass related to missing unsafe module imports. Specifically, the pty module was not included in the block list, leading to...

The vulnerability of the software responsible for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. This allows attackers to replace the XCom data, thereby bypassing the protection provided by the “enable_xcom_pickling=False” configuration setting.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to replace the XCom data, thereby bypassing the protection provided b...

PYSEC-2024-13

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

PYSEC-2024-13

Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enablexcompickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it...

PT-2024-1306

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.1 Description The issue is related to the deserialization mechanism in Apache Airflow, allowing a potential attacker to poison the XCom data by bypassing the protection of the enable xcom pickling=False...

A8: Insecure Deserialization ❗️ — Top 10 OWASP 2017

A8: Insecure Deserialization ❗️ — Top 10 OWASP 2017 Introduction ‌Insecure serialization has historically been seen as a super hard to grasp vulnerability, almost like a black box but while it does contain it’s challenges, so does every other issue type on the OWASP top 10. serialization is a...