CVE-2022-24288
Apache Airflow: RCE in example DAGs
Summary
Apache Airflow: RCE in example DAGs
Original description
The description as published by the source.
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
airflow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.4"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- web lists.apache.org