HIGH🇬🇧 English

CVE-2024-39877

CVSS 8.8v3.1pub. 2024-07-17upd. 2024-11-21

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

  • Apache Airflow

    APP
    Apache
    2.4.0 – 2.9.3 (bez)
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2020-13927CRITICAL9.8⚠ KEVten sam produkt

The previous default setting for Airflow's Experimental API was to allow all API requests without authenticati...

CVE-2026-42252CRITICAL9.1PL ✓ten sam produkt

Apache Airflow: command injection przez niebezpieczny wzorzec w dokumentacji BashOperator

CVE-2025-57735CRITICAL9.1PL ✓ten sam produkt

Apache Airflow: brak unieważnienia tokenu JWT po wylogowaniu

CVE-2024-42447CRITICAL9.8PL ✓ten sam produkt

Apache Airflow Providers FAB — nieprawidłowe wygasanie sesji (CWE-613)

CVE-2023-25754CRITICAL9.8ten sam produkt

Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affect...