CVE-2024-45498: Apache Airflow vulnerable to Improper Encoding or Escaping of Output
(updated )
Example DAG: example_inlet_event_extra.py shipped with Apache Airflow version 2.10.0 has a vulnerability that allows an authenticated attacker with only DAG trigger permission to execute arbitrary commands. If you used that example as the base of your DAGs - please review if you have not copied the dangerous example; see https://github.com/apache/airflow/pull/41873 for more information. We recommend against exposing the example DAGs in your deployment. If you must expose the example DAGs, upgrade Airflow to version 2.10.1 or later.
References
- github.com/advisories/GHSA-c392-whpc-vfpr
- github.com/apache/airflow/commit/09ec2616568f8a18e0d5fe408110fae06ddf748f
- github.com/apache/airflow/pull/41873
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-266.yaml
- lists.apache.org/thread/tl7lzczcqdmqj2pcpbvtjdpd2tb9561n
- nvd.nist.gov/vuln/detail/CVE-2024-45498
- www.openwall.com/lists/oss-security/2024/09/06/2
Code Behaviors & Features
Detect and mitigate CVE-2024-45498 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →