CVE-2022-38170
Overly permissive umask for daemons
Résumé
Overly permissive umask for daemons
Description d'origine
La description telle que publiée par la source (souvent en anglais).
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the --daemon flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Bitnami
airflow
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.4"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- web openwall.com
- web openwall.com
- web openwall.com
- web lists.apache.org