PYSEC-2022-30

At a glance

Published: 2022-02-25 09:15 UTC
Updated: 2023-12-06 01:02 UTC
CVE: CVE-2022-24288
Aliases: BIT-airflow-2022-24288, GHSA-3v7g-4pg3-7r6j

Description

In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.

Affected packages

Package	Versions
PyPI · apache-airflow	introduced 0, fixed 2.2.4

References

https://lists.apache.org/thread/dbw5ozcmr0h0lhs0yjph7xdc64oht23t WEB
https://github.com/advisories/GHSA-3v7g-4pg3-7r6j ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database