GHSA-976r-qfjj-c24w

Command injection via Celery broker in Apache Airflow

Source: GitHub Advisory Database (reviewed) Critical CVE-2020-11981

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 1.10.11rc1	1.10.11rc1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-11981 advisory
https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2 web
https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8 web
https://github.com/advisories/GHSA-976r-qfjj-c24w advisory
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml web
https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E web
https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351 web