CVE-2020-11982
2 advisories.
PyPI/apache-airflow CVE-2020-11982: critical 9.8
Insecure default config of Celery worker in Apache Airflow
Action: Upgrade apache-airflow to 1.10.11 or later.
pip install apache-airflow==1.10.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11 | - |
Fixed versions
| 1.10.11 |
Sources
- osv: GHSA-9g2w-5f3v-mfmm
- https://nvd.nist.gov/vuln/detail/CVE-2020-11982
- https://github.com/apache/airflow/pull/13612
- https://github.com/apache/airflow/pull/7205
- https://github.com/advisories/GHSA-9g2w-5f3v-mfmm
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-16.yaml
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
CVE-2020-11982 · published · modified · JSON
PyPI/apache-airflow CVE-2020-11982: unknown
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious pay
Action: Upgrade apache-airflow to 1.10.11rc1 or later.
pip install apache-airflow==1.10.11rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11rc1 | - |
Fixed versions
| 1.10.11rc1 |
Sources
- osv: PYSEC-2020-16
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- https://github.com/advisories/GHSA-9g2w-5f3v-mfmm
CVE-2020-11982 · published · modified · JSON