CVE-2020-11981
2 advisories.
PyPI/apache-airflow CVE-2020-11981: critical 9.8
Command injection via Celery broker in Apache Airflow
Action: Upgrade apache-airflow to 1.10.11rc1 or later.
pip install apache-airflow==1.10.11rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11rc1 | - |
Fixed versions
| 1.10.11rc1 |
Sources
- osv: GHSA-976r-qfjj-c24w
- https://nvd.nist.gov/vuln/detail/CVE-2020-11981
- https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
- https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
- https://github.com/advisories/GHSA-976r-qfjj-c24w
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
CVE-2020-11981 · published · modified · JSON
PyPI/apache-airflow CVE-2020-11981: unknown
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resu
Action: Upgrade apache-airflow to 1.10.11rc1 or later.
pip install apache-airflow==1.10.11rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11rc1 | - |
Fixed versions
| 1.10.11rc1 |
Sources
- osv: PYSEC-2020-15
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- https://github.com/advisories/GHSA-976r-qfjj-c24w
CVE-2020-11981 · published · modified · JSON