CVE-2022-38170

Overly permissive umask for daemons

Summary

Original description

The description as published by the source.

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV

Affected packages

Bitnami airflow

[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.4"}]}]

References

advisory nvd.nist.gov
advisory github.com
web openwall.com
web openwall.com
web openwall.com
web lists.apache.org