Hi Airflow community,
This post summaries some security vulnerabilities that were fixed in
Airflow 1.9.0 (which is quite a while ago now) but that we never
formally reported as such.
If you are still on 1.8.2 or earlier we strongly encourage you to
upgrade to the latest version, but at least to 1.9.0 to get fixes for
these CVEs.
CVE-2017-15720: An authenticated user can execute code remotely on the
Airflow webserver by creating a special object.
CVE-2017-17835: CSRF Vulnerabilities - One of which allowed for a remote
command injection on a default install of Airflow
CVE-2017-17836: An experimental Airflow feature displayed authenticated
cookies, as well as passwords to databases used by Airflow. An attacker
who has limited access to airflow, weather it be via XSS or by leaving a
machine unlocked. An attacker can exfil all credentials from the system.
These are quite old so I am have not managed to attribute these to any
specific reporter. If you reported one of these: sorry, and let me know
(off list) and I will correct this.
Thanks,
Ash
