Опубликовано: 25 янв. 2019
Источник: github
Github: Прошло ревью
CVSS4: 8.7
CVSS3: 8.8
Описание
Improper Input Validation in Apache Airflow resulting in Remote Code Execution
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2017-15720
- https://github.com/apache/airflow/commit/04cacdd0a7526927137b452f38c3e894a5d2ce4a
- https://github.com/apache/airflow/commit/daa281c0364609d6812921123cf47e4118b40484
- https://github.com/advisories/GHSA-8fg4-j562-mjrc
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-147.yaml
- https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
Пакеты
Наименование
apache-airflow
pip
Затронутые версииВерсия исправления
<= 1.8.2
1.9.0
Связанные уязвимости
CVSS3: 8.8
nvd
около 7 лет назад
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.
CVSS3: 8.8
debian
около 7 лет назад
In Apache Airflow 1.8.2 and earlier, an authenticated user can execute ...