CVE-2020-13927
2 advisories.
PyPI/apache-airflow CVE-2020-13927: critical 9.8, exploited, EPSS 99.78%
Authentication bypass in Apache Airflow
Action: Upgrade apache-airflow to 1.10.11 or later.
pip install apache-airflow==1.10.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11 | - |
Fixed versions
| 1.10.11 |
Sources
- osv: GHSA-hhx9-p69v-cx2j
- kev: CVE-2020-13927
- https://nvd.nist.gov/vuln/detail/CVE-2020-13927
- https://github.com/apache/airflow/pull/9611
- https://github.com/apache/airflow/commit/180bca4f993b7b778a8d2c65d3d357652218922b
- https://github.com/apache/airflow/commit/9e305d6b810a2a21e2591a80a80ec41acb3afed0
- https://airflow.apache.org/docs/apache-airflow/1.10.11/security.html#api-authentication
- https://github.com/advisories/GHSA-hhx9-p69v-cx2j
- https://github.com/apache/airflow
- https://github.com/apache/airflow/releases/tag/1.10.11
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-18.yaml
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13927
- http://packetstormsecurity.com/files/162908/Apache-Airflow-1.10.10-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174764/Apache-Airflow-1.10.10-Remote-Code-Execution.html
CVE-2020-13927 · published · modified · JSON
PyPI/apache-airflow CVE-2020-13927: unknown, exploited, EPSS 99.78%
The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. From Airflow 1.10.11 the de
Action: Upgrade apache-airflow to 1.10.11 or later.
pip install apache-airflow==1.10.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.10.11 | - |
Fixed versions
| 1.10.11 |
Sources
- osv: PYSEC-2020-18
- kev: CVE-2020-13927
- https://lists.apache.org/thread.html/r23a81b247aa346ff193670be565b2b8ea4b17ddbc7a35fc099c1aadd%40%3Cdev.airflow.apache.org%3E
- https://github.com/advisories/GHSA-hhx9-p69v-cx2j
CVE-2020-13927 · published · modified · JSON