CVE-2024-32077

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs.  Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Score

CVSS 3.1 5.4 Medium

Status

Modified - security@apache.org

Published

2024-05-14

Last modified

2025-03-27

Weaknesses

CWE-79

Affected products

• Airflow (Apache)
• Apache Airflow (Apache Software Foundation)

References

• http://www.openwall.com/lists/oss-security/2024/05/14/1
• https://github.com/apache/airflow/pull/38882
• https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77