CVE-2020-11981: OS Command Injection
First published: Thu Jul 16 2020(Updated: )
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Airflow | <=1.10.10 | |
| pip/apache-airflow | >=0<1.10.11rc1 | 1.10.11rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E
- https://nvd.nist.gov/vuln/detail/CVE-2020-11981
- https://github.com/apache/airflow/commit/afa4b11fddfdbadb048f742cf66d5c21c675a5c8
- https://web.archive.org/web/20220427031325/https://issues.apache.org/jira/browse/AIRFLOW-6351
- https://github.com/apache/airflow/commit/1dda6fdde7c6bcaf0d6534786beeeba868006dd2
- https://github.com/advisories/GHSA-976r-qfjj-c24w (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-15.yaml
Frequently Asked Questions
What is CVE-2020-11981?
CVE-2020-11981 is a vulnerability found in Apache Airflow versions 1.10.10 and below that allows an attacker to run arbitrary commands by injecting commands through the CeleryExecutor when the broker (Redis, RabbitMQ) is directly accessible.
How severe is CVE-2020-11981?
CVE-2020-11981 has a severity score of 9.8, which is classified as critical.
How can I check if my Apache Airflow version is affected by CVE-2020-11981?
You can check if your Apache Airflow version is affected by CVE-2020-11981 by verifying if it is version 1.10.10 or below.
What is the fix for CVE-2020-11981?
The fix for CVE-2020-11981 is to upgrade to Apache Airflow version 1.10.11 or later.
Where can I find more information about CVE-2020-11981?
You can find more information about CVE-2020-11981 on the NIST National Vulnerability Database (NVD), the Apache Airflow mailing list, and the official Apache Airflow GitHub repository.
- collector/nvd-index
- agent/type
- agent/weakness
- agent/severity
- agent/description
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-976r-qfjj-c24w
- alias/CVE-2020-11981
- agent/last-modified-date
- agent/tags
- agent/references
- collector/github-advisory
- agent/softwarecombine
- agent/trending
- vendor/apache
- canonical/apache airflow
- version/apache airflow/1.10.10
- package-manager/pip