Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors
    to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which
    should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or
    later which has removed the vulnerability. (CVE-2024-39877)

ID	Name	Product	Family	Type	Severity
463492	Echo: apache-airflow: security update to 2.9.3	Tenable Cloud Security	Echo Local Security Checks	Local	high
463492	Echo: apache-airflow: security update to 2.9.3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
414895	SCA: security update for apache-airflow (GHSA-g5hv-r743-v8pm)	Tenable Cloud Security	SCA Checks	Local	high
414895	SCA: security update for apache-airflow (GHSA-g5hv-r743-v8pm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2024-39877

high

Tenable Plugins

high

high

high

high