PT-2021-21067 · Apache · Apache Airflow

Dolev Farhi · Published 2021-08-16 · Updated 2024-03-06 · CVE-2021-35936

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.1.2

Description: The issue affects the logging server in Apache Airflow, which has no authentication and allows reading log files of DAG jobs when remote logging is not used. This could potentially expose sensitive information.

Recommendations: For versions prior to 2.1.2, update to version 2.1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the logging server or disabling it when not in use to minimize the risk of exploitation.

Fix

Missing Authorization

Information Disclosure

Missing Authentication

Weakness Enumeration

CWE-862

CWE-200

CWE-306

Related Identifiers

BIT-AIRFLOW-2021-35936

CVE-2021-35936

GHSA-M6H2-JX9V-58W6

PYSEC-2021-122

Affected Products

Apache Airflow

References · 13

• https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-35936 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m6h2-jx9v-58w6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35936 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-122 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2021-35936 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/compare/2.1.1...2.1.2 · Note
• https://github.com/apache/airflow/commit/27265516d2b897585f5019ecd820cfe5471fd351 · Note
• https://github.com/apache/airflow/commit/d772f38f843b9add5319a01cf51a844145b01f63 · Note
• https://github.com/apache/airflow/commit/7a5bb88ad78d600fbb1676a55752597928115bd8 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-122.yaml · Note
• https://github.com/advisories/GHSA-m6h2-jx9v-58w6 · Note