oss-sec mailing list archives
CVE-2021-45230: Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver
From: Kaxil Naik <kaxilnaik () apache org>
Date: Wed, 19 Jan 2022 14:08:03 +0000
Description: This CVE applies to a specific case where a User who has "can_create" permissions on DAG Runs can create Dag Runs for dags that they don't have "edit" permissions for. This is a very low severity CVE and admins can mitigate this issue by removing the global "can_create" permissions on DagRun for Airflow versions >=2.0.0,<2.2.0 and 1.10.x versions that have set `rbac=True` in config. Credit: Apache Airflow PMC would like to thank Franco Cano Erazo for reporting this issue. References: https://lists.apache.org/thread/m778ojn0k595rwco4ht9wjql89mjoxnl
Current thread:
- CVE-2021-45230: Apache Airflow: Creating DagRuns didn't respect Dag-level permissions in the Webserver Kaxil Naik (Jan 19)