PyPI/apache-airflow CVE-2020-11981: unknown, EPSS 36.79%
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resu
Action: Upgrade apache-airflow to 1.10.11rc1 or later.
pip install apache-airflow==1.10.11rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11rc1 | - |
Fixed versions
| 1.10.11rc1 |
Sources
- osv: PYSEC-2020-15
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- https://github.com/advisories/GHSA-976r-qfjj-c24w
CVE-2020-11981 · published · modified · JSON