Description
In Apache Airflow prior to 2.2.0. This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | Apache Airflow 1.10 1.10.0 to 1.10.15, Apache Airflow 2 – < 2.2.0 | 2.2.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 2.2.0 | 2.2.0 | GHSA-4jh2-3c85-q67h |
| PyPI | apache-airflow | >= 1.10.0, < 2.0.0b1 · >= 2.0.0, < 2.2.0 | 2.0.0b1, 2.2.0 | PYSEC-2022-11 |