CVE-2021-35936

Опубликовано: 16 авг. 2021

Источник: nvd

CVSS3: 5.3

CVSS2: 5

EPSS Низкий

Описание

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

Ссылки

https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E
Mailing List
Vendor Advisory
https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E
Mailing List
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

Версия до 2.1.2 (исключая)

EPSS

Процентиль: 80%

0.01403

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

CWE-306

Связанные уязвимости

CVE-2021-35936

CVSS3: 5.3

debian

больше 4 лет назад

If remote logging is not used, the worker (in the case of CeleryExecut ...

GHSA-m6h2-jx9v-58w6

CVSS3: 5.3

github

больше 4 лет назад

Missing Authorization in Apache Airflow

EPSS

Процентиль: 80%

0.01403

Низкий

5.3 Medium

CVSS3

5 Medium

CVSS2

Дефекты

CWE-200

CWE-306