GHSA-52gm-qmg3-r4qp

Apache Airflow: XSS vulnerability in Task Instance Log/Log Details

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-32077

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	>= 2.9.0, < 2.9.1	2.9.1

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-32077 advisory
https://github.com/apache/airflow/pull/38882 web
https://github.com/apache/airflow/commit/87acf61f574daf47ce9e03a986e352a2c727f4ce web
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-264.yaml web
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77 web
http://www.openwall.com/lists/oss-security/2024/05/14/1 web