CVE-2024-45034

HIGH8.8EPSS 3.1%

Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes

發布日:2024/9/7修改日:2025/5/20

也稱為:GHSA-92xg-gmrq-5c3wBIT-airflow-2024-45034CGA-6phc-rh2r-v49mPYSEC-2024-212

描述

Apache Airflow versions before 2.10.1 have a vulnerability that allows DAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later, which has fixed the vulnerability.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.10.1
PyPI/apache-airflowfrom 0, < 2.10.1
PyPI/apache-airflowfrom 0, < 2.10.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-45034
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d
WEBhttps://github.com/apache/airflow/pull/41672
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-212.yaml
WEBhttps://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx
WEBhttp://www.openwall.com/lists/oss-security/2024/09/06/3