Apache Software Foundation · Apache Airflow
Apache Airflow versions prior to 2.2.4 contain an OS command injection flaw in some of its example DAGs, which fail to properly sanitize user-provided params. An attacker who can supply params through the web UI can inject operating system commands that the DAG executes.
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
First seen exploited 21 months after disclosure.
7 fixes in apache-airflow over 14 months. The latest fix listed for apache-airflow is 2.3.0.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: apache-airflow.
Upgrade to 2.4.3 or later
Fixes this CVE and 5 other known vulnerabilities in this package (CVE-2020-11978, CVE-2020-13927, +3).
pip install "apache-airflow>=2.4.3"First fixed in 2.2.4 for CVE-2022-24288.
| If you run | Upgrade to |
|---|---|
| All versions before 2.2.4 | 2.4.3first fix for this CVE: 2.2.4 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.