CVE-2020-11982

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

History

21 Nov 2024, 04:59

Type Values Removed Values Added
References () https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E - Mailing List, Vendor Advisory () https://lists.apache.org/thread.html/r7255cf0be3566f23a768e2a04b40fb09e52fcd1872695428ba9afe91%40%3Cusers.airflow.apache.org%3E - Mailing List, Vendor Advisory

Information

Published : 2020-07-17 00:15

Updated : 2024-11-21 04:59


NVD link : CVE-2020-11982

Mitre link : CVE-2020-11982

CVE.ORG link : CVE-2020-11982


JSON object : View

Products Affected

apache

  • airflow
CWE
CWE-502

Deserialization of Untrusted Data