Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 19 Jan 2022 14:08:03 +0000
From: Kaxil Naik <kaxilnaik@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-45230: Apache Airflow: Creating DagRuns didn't respect
 Dag-level permissions in the Webserver 

Description:

This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for. 

This is a very low severity CVE and admins can mitigate this issue by removing the global "can_create" permissions on DagRun for Airflow versions >=2.0.0,<2.2.0 and 1.10.x versions that have set `rbac=True` in config.

Credit:

Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue.

References:

https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.