CVE-2024-45498 Apache Airflow: Command Injection in an example DAG

2024-09-0707:43:43

CWE-116

apache

www.cve.org

cve-2024-45498

apache airflow

command injection

example dag

vulnerability

authenticated attacker

arbitrary commands

dag trigger permission

github pull request

upgrade airflow

EPSS

Percentile

9.5%

JSON

Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.

CNA Affected

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "status": "affected",
        "version": "2.10.0",
        "versionType": "semver"
      }
    ]
  }
]