CVE-2024-32077

MEDIUM5.4EPSS 3.4%

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

發布日:2024/5/14修改日:2026/5/20

也稱為:GHSA-52gm-qmg3-r4qpBIT-airflow-2024-32077PYSEC-2024-264

描述

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

受影響套件(3)

Bitnami/airflow>= 2.9.0, < 2.9.1
PyPI/apache-airflow>= 2.9.0, < 2.9.1
PyPI/apache-airflowfrom 0, <= 2.9.0-NA, <= 2.9.0-beta1, <= 2.9.0-beta2, <= 2.9.0-rc1, <= 2.9.0-rc2, <= 2.9.0-rc3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	MEDIUM5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-32077
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce
WEBhttps://github.com/apache/airflow/pull/38882
WEBhttps://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
WEBhttp://www.openwall.com/lists/oss-security/2024/05/14/1