CVE-2020-11982: Critical severity apache airflow vulnerability
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-11982?
CVE-2020-11982 is considered a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2020-11982?
To remediate CVE-2020-11982, upgrade to Apache Airflow version 1.10.11 or later.
Which versions of Apache Airflow are affected by CVE-2020-11982?
Apache Airflow versions 1.10.10 and below are affected by CVE-2020-11982.
What type of attack does CVE-2020-11982 allow?
CVE-2020-11982 allows a deserialization attack potentially leading to remote code execution if the attacker can connect to the message broker.
What kind of message brokers are involved in CVE-2020-11982?
CVE-2020-11982 involves message brokers like Redis and RabbitMQ when using the CeleryExecutor.