Skip to content
OpenAdvisories
High · 8.8 CVE-2017-15720 EUVD-2019-0012GHSA-8fg4-j562-mjrcPYSEC-2019-147

Improper Input Validation in Apache Airflow resulting in Remote Code Execution

Published Jan 23, 2019 · Updated Sep 16, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow 1.8.2 and earlier, an authenticated user can execute code remotely on the Airflow webserver by creating a special object.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow Apache Airflow <= 1.8.2 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 1.9.0 1.9.0 GHSA-8fg4-j562-mjrc

References