Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2020-11981
9.8
CRITICALCVSS v3
Published
July 17, 2020
CVSS v2
7.5 HIGH
Affected
1 project
Assigned by
Apache
Severity scale
010
Description
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.
apache/airflow
GitHubApache Airflow - A platform to programmatically author, schedule, and monitor workflows
GitHubApache Airflow - A platform to programmatically author, schedule, and monitor workflows<= 1.10.10NVD