Date: Tue, 8 Jan 2019 22:18:19 +0000 From: Ash Berlin-Taylor <ash@...che.org> To: dev@...flow.apache.org, Apache Security Team <security@...che.org>, oss-security@...ts.openwall.com Cc: Seth Long <seth.long@...ditkarma.com> Subject: RCE, CSRF and Information leak vulnerabilities against Airflow <= 1.8.2 (CVE-2017-15720, CVE-2017-17835, CVE-2017-17836) Hi Airflow community, This post summaries some security vulnerabilities that were fixed in Airflow 1.9.0 (which is quite a while ago now) but that we never formally reported as such. If you are still on 1.8.2 or earlier we strongly encourage you to upgrade to the latest version, but at least to 1.9.0 to get fixes for these CVEs. CVE-2017-15720: An authenticated user can execute code remotely on the Airflow webserver by creating a special object. CVE-2017-17835: CSRF Vulnerabilities - One of which allowed for a remote command injection on a default install of Airflow CVE-2017-17836: An experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked. An attacker can exfil all credentials from the system. These are quite old so I am have not managed to attribute these to any specific reporter. If you reported one of these: sorry, and let me know (off list) and I will correct this. Thanks, Ash
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.