PT-2022-24256 · Apache · Apache Airflow

Harry Sintonen · Published 2022-09-02 · Updated 2026-02-20 · CVE-2022-38170

Positive Technologies (AI Summary)

CVSS v4.0

5.7

Medium

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.3.4

Description The issue is related to an insecure umask configuration in Apache Airflow when running with the --daemon flag. This could lead to a race condition, resulting in world-writable files in the Airflow home directory. Local users could exploit this to expose arbitrary file contents via the webserver.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue. As a temporary workaround, consider running Airflow without the --daemon flag until the update is applied. Restrict access to the Airflow home directory to minimize the risk of exploitation.

Fix

Race Condition

Incorrect Permission

Weakness Enumeration

CWE-362

CWE-732

Related Identifiers

BIT-AIRFLOW-2022-38170

CVE-2022-38170

GHSA-Q8H9-PQCX-59HW

PYSEC-2022-261

Affected Products

Apache Airflow

References · 16

• https://osv.dev/vulnerability/CVE-2022-38170 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2022-38170 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2022-261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38170 · Security Note
• https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8h9-pqcx-59hw · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2022-38170 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/c14ea8f0f34944d2ecfa9021d167602e8b2b8b90 · Note
• https://github.com/apache/airflow/commit/bf01d10cd348e679916034de1befb79ec6e46ff8 · Note
• https://github.com/apache/airflow/commit/b6a2cd1aa34f69a36ea127e4f7f5ba87f4aca420 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-261.yaml · Note
• http://openwall.com/lists/oss-security/2022/09/02/3 · Note
• http://openwall.com/lists/oss-security/2022/09/21/2 · Note
• https://github.com/advisories/GHSA-q8h9-pqcx-59hw · Note