PYSEC-2020-15

En bref

Publiée: 2020-07-17 00:15 UTC
Mise à jour: 2023-12-06 01:00 UTC
CVE: CVE-2020-11981
Alias: BIT-airflow-2020-11981, GHSA-976r-qfjj-c24w

Description

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

Paquets affectés

Paquet	Versions
PyPI · apache-airflow	introduced 0, fixed 1.10.11rc1

Références

https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E WEB
https://github.com/advisories/GHSA-976r-qfjj-c24w ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database