{"action":"Upgrade apache-airflow to 1.10.11rc1 or later.","affected":[{"fixed":"1.10.11rc1","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2020-11981"],"ecosystem":"PyPI","epss":0.36787,"exploited":false,"fixed_versions":["1.10.11rc1"],"ghsa_id":"GHSA-976r-qfjj-c24w","id":"tcs_01M5KG9JWZ4QKR760FZFPSQMMA","modified_at":"2023-12-06T01:00:02.698332Z","published_at":"2020-07-17T00:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-15","https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E","https://github.com/advisories/GHSA-976r-qfjj-c24w"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-15","url":"https://osv.dev/vulnerability/PYSEC-2020-15"}],"summary":"An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resu"}