PT-2024-24381 · Apache · Apache Airflow

Jens Scheffler + 1 · Published 2024-05-14 · Updated 2024-12-11 · CVE-2024-32077

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow version 2.9.0

Description The issue allows an authenticated attacker to inject malicious data into the task instance logs. This is a critical security vulnerability that enables attackers to inject data into the task instance logs.

Recommendations For Apache Airflow version 2.9.0, upgrade to version 2.9.1 to fix the issue. As a temporary workaround, consider restricting access to the task instance logs until the upgrade is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-AIRFLOW-2024-32077

CVE-2024-32077

GHSA-52GM-QMG3-R4QP

PYSEC-2024-264

Affected Products

Apache Airflow

References · 12

• https://github.com/apache/airflow/pull/38882 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-32077 · Security Note
• https://osv.dev/vulnerability/GHSA-52gm-qmg3-r4qp · Vendor Advisory
• https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-32077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32077 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-264 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce · Note
• http://openwall.com/lists/oss-security/2024/05/14/1 · Note
• https://twitter.com/Hossted_OSS/status/1798595683253154271 · Twitter Post
• https://twitter.com/oss_security/status/1791152158538072234 · Twitter Post