Apache Airflow vulnerable to Execution with Unnecessary Privileges
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-45034US | — | — | ||
Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2024/09/06/3WEB
- https://github.com/apache/airflowPACKAGE
- https://github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6dWEB
- https://github.com/apache/airflow/pull/41672WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-212.yamlWEB
- https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjxWEB
- https://nvd.nist.gov/vuln/detail/CVE-2024-45034ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan