CVE-2024-39877

HIGH8.8EPSS 0.13%

Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler

發布日:2024/7/17修改日:2025/5/20

也稱為:GHSA-g5hv-r743-v8pmBIT-airflow-2024-39877PYSEC-2024-190

描述

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

受影響套件(3)

Bitnami/airflow>= 2.4.0, < 2.9.3
PyPI/apache-airflow>= 2.4.0, < 2.9.3
PyPI/apache-airflow>= 2.4.0, < 2.9.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-39877
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/8159f6e24704f5e0e3b3217cf79ecf5083dce531
WEBhttps://github.com/apache/airflow/pull/40522
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-190.yaml
WEBhttps://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1
WEBhttp://www.openwall.com/lists/oss-security/2024/07/16/7