PT-2020-22667 · Apache · Apache Airflow

Published 2020-01-14 · Updated 2020-01-14

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 1.10.5

Description A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views when running with the "classic" UI. The new "RBAC" UI is unaffected.

Recommendations For versions prior to 1.10.5, update to version 1.10.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the "classic" UI until the update is applied.

Related Identifiers

PYSEC-2020-181

Affected Products

Apache Airflow

References · 4

• https://osv.dev/vulnerability/PYSEC-2020-181 · Vendor Advisory
• https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b@%3Cdev.airflow.apache.org%3E · Note
• http://openwall.com/lists/oss-security/2020/01/14/2 · Note
• https://lists.apache.org/thread.html/r72487ad6b23d18689896962782f8c93032afe5c72a6bfd23b253352b%40%3Cusers.airflow.apache.org%3E · Note