logo

Database

OS Command Injection In apache-airflow

Description

Remote code execution (RCE) in Apache Airflow An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-119782. NVD-2020-119783. OSV-2020-119784. GCVE-2020-11978

References

1. https://github.com/apache/airflow/pull/91432. https://github.com/apache/airflow/commit/2fa51576e1283f5732e38fada686fd248d9c3a1e3. https://github.com/apache/airflow/commit/4d8599e8b0520ff4226fbad72f724afae50fdd084. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-14.yaml5. https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E6. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-119787. http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html8. http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html9. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-11978.yaml10. https://github.com/pberba/CVE-2020-1197811. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_airflow_dag_rce.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.