PYSEC-2020-15

At a glance

Published: 2020-07-17 00:15 UTC
Updated: 2023-12-06 01:00 UTC
CVE: CVE-2020-11981
Aliases: BIT-airflow-2020-11981, GHSA-976r-qfjj-c24w

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Affected packages

Package	Versions
PyPI · apache-airflow	introduced 0, fixed 1.10.11rc1

References

https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E WEB
https://github.com/advisories/GHSA-976r-qfjj-c24w ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database