GHSA-m6h2-jx9v-58w6

Missing Authorization in Apache Airflow

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-35936

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 2.1.2	2.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds on 0.0.0.0 by default. This logging server had no authentication and allows reading log files of DAG jobs. This issue affects Apache Airflow < 2.1.2.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-35936 advisory
https://github.com/apache/airflow/commit/27265516d2b897585f5019ecd820cfe5471fd351 web
https://github.com/apache/airflow/commit/7a5bb88ad78d600fbb1676a55752597928115bd8 web
https://github.com/apache/airflow/commit/d772f38f843b9add5319a01cf51a844145b01f63 web
https://github.com/advisories/GHSA-m6h2-jx9v-58w6 advisory
https://github.com/apache/airflow package
https://github.com/apache/airflow/compare/2.1.1...2.1.2 web
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2021-122.yaml web
https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E web