PYSEC-2022-11
At a glance
- Published
- Updated
- CVE
- CVE-2021-45230
- Aliases
- BIT-airflow-2021-45230, GHSA-4jh2-3c85-q67h
Description
In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 1.10.0, fixed 2.0.0b1, introduced 2.0.0, fixed 2.2.0 |
References
- https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl WEB
- https://github.com/advisories/GHSA-4jh2-3c85-q67h ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |