Lucene search

Veracode Vulnerability DatabaseVERACODE:46062

HistoryMar 28, 2024 - 10:20 a.m.

Improper Preservation Of Permissions

2024-03-2810:20:54

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

apache airflow

improper preservation

permissions

vulnerability

local file task handler

parent folders

unintended group access

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Apache Airflow is vulnerable to Improper Preservation of Permissions. This vulnerability is caused due to Airflow’s local file task handler incorrectly setting permissions for parent folders of the log folder, potentially granting unintended group write access.

CPENameOperatorVersion
apache-airflowle2.8.4rc1
apache-airflowle2.8.4rc1

CPE	Name	Operator	Version
	apache-airflow	le	2.8.4rc1
	apache-airflow	le	2.8.4rc1

References

www.openwall.com/lists/oss-security/2024/03/26/2

github.com/advisories/GHSA-cff3-5qrp-hqx7

github.com/apache/airflow/commit/e6ab8fc158d377f1593fdddf7dd35a9200964d35

github.com/apache/airflow/pull/37310

lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536