Remote code execution in Apache Airflow Docker's Provider
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-38362US | high8.8 | — | ||
Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2022/08/16/1WEB
- https://github.com/advisories/GHSA-746v-hfh2-xphmADVISORY
- https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkbWEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-38362ADVISORY
- https://pypi.org/project/apache-airflow-providers-dockerPACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan