CVE-2020-11981: OS Command Injection
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11981?
CVE-2020-11981 is a vulnerability found in Apache Airflow versions 1.10.10 and below that allows an attacker to run arbitrary commands by injecting commands through the CeleryExecutor when the broker (Redis, RabbitMQ) is directly accessible.
How severe is CVE-2020-11981?
CVE-2020-11981 has a severity score of 9.8, which is classified as critical.
How can I check if my Apache Airflow version is affected by CVE-2020-11981?
You can check if your Apache Airflow version is affected by CVE-2020-11981 by verifying if it is version 1.10.10 or below.
What is the fix for CVE-2020-11981?
The fix for CVE-2020-11981 is to upgrade to Apache Airflow version 1.10.11 or later.
Where can I find more information about CVE-2020-11981?
You can find more information about CVE-2020-11981 on the NIST National Vulnerability Database (NVD), the Apache Airflow mailing list, and the official Apache Airflow GitHub repository.