CVE-2024-39877

CWE-94 — Code InjectionCWE-2775 documents4 sources
Severity
8.8HIGH
EPSS
0.1%
top 73.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache AirflowApache Airflow
Timeline
PublishedJul 17

Description

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶NVDapache/airflow2.4.0 — 2.9.3
▶PyPIapache-airflow2.4.0 — 2.9.3

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler↗2024-07-17
▶
CVEList
Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler↗2024-07-17
▶
OSV
CVE-2024-39877: Apache Airflow 2↗2024-07-17
▶
GHSA
Apache Airflow has DAG Author Code Execution possibility in airflow-scheduler↗2024-07-17
▶
CVE-2024-39877 (HIGH CVSS 8.8) | Apache Airflow 2.4.0 | cvebase.io