GHSA-976r-qfjj-c24w

Command injection via Celery broker in Apache Airflow

En bref

Publiée: 2020-07-27 16:57 UTC
Mise à jour: 2024-09-11 21:24 UTC
CVE: CVE-2020-11981
Alias: BIT-airflow-2020-11981, PYSEC-2020-15
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Paquets affectés

Paquet	Versions
PyPI · apache-airflow	introduced 0, fixed 1.10.11rc1

Références

https://nvd.nist.gov/vuln/detail/CVE-2020-11981 ADVISORY
https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2 WEB
https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8 WEB
https://github.com/advisories/GHSA-976r-qfjj-c24w ADVISORY
https://github.com/apache/airflow PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml WEB
https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E WEB
https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database