Vulnerability Details CVE-2024-32077
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.
Users are recommended to upgrade to version 2.9.1, which fixes this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.015
EPSS Ranking 79.9%
CVSS Severity
CVSS v3 Score 5.4
References
- http://www.openwall.com/lists/oss-security/2024/05/14/1
- https://github.com/apache/airflow/pull/38882
- https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
- http://www.openwall.com/lists/oss-security/2024/05/14/1
- https://github.com/apache/airflow/pull/38882
- https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77