Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 16 Aug 2022 14:20:50 +0100
From: Ash Berlin-Taylor <ash@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2022-38362: Apache Airflow Docker Provider <3.0 RCE vulnerability
 in example dag

Description:

Apache Airflow Docker's Provider shipped with an example DAG that was 
vulnerable to (authenticated) remote code exploit of code on the 
Airflow worker host.


Mitigation:

Disable loading of example DAGs or upgrade the 
apache-airflow-providers-docker to 3.0.0 or above

Credit:

Thanks to Kai Zhao of 3H Secruity Team for reporting this


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.