| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow | < 1.10.11< 1.10.11rc1 | 1.10.111.10.11rc1 |
| airflow | ≤ 1.10.10 |
An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free