GHSA-976r-qfjj-c24w
Command injection via Celery broker in Apache Airflow
At a glance
- Published
- Updated
- CVE
- CVE-2020-11981
- Aliases
- BIT-airflow-2020-11981, PYSEC-2020-15
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 1.10.11rc1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-11981 ADVISORY
- https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2 WEB
- https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8 WEB
- https://github.com/advisories/GHSA-976r-qfjj-c24w ADVISORY
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml WEB
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E WEB
- https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |