cve-2024-29735
Vulnerability from cvelistv5
Published
2024-03-26 16:52
Modified
2024-08-29 18:27
Severity ?
EPSS score ?
Summary
Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3.
Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem.
If your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable.
This issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway.
You are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users.
Also you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems.
Recommendation for users using Airflow outside of the containers:
* if you are using root to run Airflow, change your Airflow user to use non-root
* upgrade Apache Airflow to 2.8.4 or above
* If you prefer not to upgrade, you can change the https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions to 0o755 (original value 0o775).
* if you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of AIRFLOW_HOME/logs in all your components and all parent directories of this directory and remove group write access for all the parent directories
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | Apache Software Foundation | Apache Airflow |
Version: 2.8.2 ≤ 2.8.3 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.479Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/apache/airflow/pull/37310"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536"
},
{
"tags": [
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/03/26/2"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "airflow",
"vendor": "apache",
"versions": [
{
"lessThanOrEqual": "2.8.3",
"status": "affected",
"version": "2.8.2",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-29735",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-08-08T14:08:38.417026Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-08-29T18:27:39.696Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pypi.python.org",
"defaultStatus": "unaffected",
"packageName": "apache-airflow",
"product": "Apache Airflow",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.8.3",
"status": "affected",
"version": "2.8.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matej Murin"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Preservation of Permissions vulnerability in Apache Airflow.\u003cp\u003eThis issue affects Apache Airflow from 2.8.2 through 2.8.3.\u003c/p\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eAirflow\u0027s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix \u003ccode\u003egroup\u003c/code\u003e\u0026nbsp;of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem.\u003c/p\u003e\u003cp\u003eIf your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable.\u003c/p\u003e\u003cp\u003eThis issue does not affect users who use or extend Airflow using Official Airflow Docker reference images (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://hub.docker.com/r/apache/airflow/\"\u003ehttps://hub.docker.com/r/apache/airflow/\u003c/a\u003e) - those images require to have group write permission set anyway.\u003c/p\u003e\u003cp\u003eYou are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users.\u003c/p\u003e\u003cp\u003eAlso you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems.\u003c/p\u003e\u003cp\u003eRecommendation for users using Airflow outside of the containers:\u003c/p\u003e\u003cul\u003e\u003cli\u003eif you are using root to run Airflow, change your Airflow user to use non-root\u003c/li\u003e\u003cli\u003eupgrade Apache Airflow to 2.8.4 or above\u003c/li\u003e\u003cli\u003eIf you prefer not to upgrade, you can change the \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions\"\u003ehttps://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions\u003c/a\u003e\u0026nbsp;to 0o755 (original value 0o775).\u003c/li\u003e\u003cli\u003eif you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of \u003ccode\u003eAIRFLOW_HOME/logs\u003c/code\u003e\u0026nbsp;in all your components and all parent directories of this directory and remove group write access for all the parent directories\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e\u003cp\u003e\u003c/p\u003e"
}
],
"value": "Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3.\n\nAirflow\u0027s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group\u00a0of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem.\n\nIf your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable.\n\nThis issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway.\n\nYou are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users.\n\nAlso you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems.\n\nRecommendation for users using Airflow outside of the containers:\n\n * if you are using root to run Airflow, change your Airflow user to use non-root\n * upgrade Apache Airflow to 2.8.4 or above\n * If you prefer not to upgrade, you can change the https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions \u00a0to 0o755 (original value 0o775).\n * if you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of AIRFLOW_HOME/logs\u00a0in all your components and all parent directories of this directory and remove group write access for all the parent directories\n\n"
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281: Improper Preservation of Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-03-26T16:52:40.770Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/airflow/pull/37310"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536"
},
{
"url": "http://www.openwall.com/lists/oss-security/2024/03/26/2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Airflow: Potentially harmful permission changing by log task handler",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2024-29735",
"datePublished": "2024-03-26T16:52:40.770Z",
"dateReserved": "2024-03-19T11:07:02.111Z",
"dateUpdated": "2024-08-29T18:27:39.696Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2024-29735\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-03-26T17:15:47.380\",\"lastModified\":\"2024-11-21T09:08:11.857\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3.\\n\\nAirflow\u0027s local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group\u00a0of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem.\\n\\nIf your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable.\\n\\nThis issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway.\\n\\nYou are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docker containers are used as intended, i.e. where Airflow components do not share containers with other applications and users.\\n\\nAlso you should not be affected if your umask is 002 (group write enabled) - this is the default on many linux systems.\\n\\nRecommendation for users using Airflow outside of the containers:\\n\\n * if you are using root to run Airflow, change your Airflow user to use non-root\\n * upgrade Apache Airflow to 2.8.4 or above\\n * If you prefer not to upgrade, you can change the https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions \u00a0to 0o755 (original value 0o775).\\n * if you already ran Airflow tasks before and your default umask is 022 (group write disabled) you should stop Airflow components, check permissions of AIRFLOW_HOME/logs\u00a0in all your components and all parent directories of this directory and remove group write access for all the parent directories\\n\\n\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de conservaci\u00f3n inadecuada de permisos en Apache Airflow. Este problema afecta a Apache Airflow desde la versi\u00f3n 2.8.2 hasta la 2.8.3. El controlador de tareas de archivos locales de Airflow en Airflow configur\u00f3 incorrectamente permisos para todas las carpetas principales de la carpeta de registro, en la configuraci\u00f3n predeterminada agrega acceso de escritura al grupo de carpetas de Unix. En el caso de que Airflow se ejecute con el usuario root (no recomendado), agreg\u00f3 permiso de escritura grupal a todas las carpetas hasta la ra\u00edz del sistema de archivos. Si sus archivos de registro est\u00e1n almacenados en el directorio de inicio, estos cambios de permisos pueden afectar su capacidad para ejecutar operaciones SSH despu\u00e9s de que su directorio de inicio se pueda escribir en grupo. Este problema no afecta a los usuarios que usan o ampl\u00edan Airflow utilizando im\u00e1genes de referencia oficiales de Airflow Docker (https://hub.docker.com/r/apache/airflow/); de todos modos, esas im\u00e1genes requieren tener configurado el permiso de escritura grupal. Solo se ver\u00e1 afectado si instala Airflow usando la instalaci\u00f3n local/virtualenv u otras im\u00e1genes de Docker, pero el problema no tiene ning\u00fan impacto si los contenedores de Docker se usan seg\u00fan lo previsto, es decir, cuando los componentes de Airflow no comparten contenedores con otras aplicaciones y usuarios. Adem\u00e1s, no deber\u00eda verse afectado si su umask es 002 (escritura en grupo habilitada); este es el valor predeterminado en muchos sistemas Linux. Recomendaci\u00f3n para usuarios que usan Airflow fuera de los contenedores: * si est\u00e1 usando root para ejecutar Airflow, cambie su usuario de Airflow para usar no root * actualice Apache Airflow a 2.8.4 o superior * Si prefiere no actualizar, puede cambiar los https://airflow.apache.org/docs/apache-airflow/stable/configurations-ref.html#file-task-handler-new-folder-permissions a 0o755 (valor original 0o775). * si ya ejecut\u00f3 tareas de Airflow antes y su umask predeterminada es 022 (escritura grupal deshabilitada), debe detener los componentes de Airflow, verificar los permisos de AIRFLOW_HOME/logs en todos sus componentes y todos los directorios principales de este directorio y eliminar el acceso de escritura grupal para todos los directorios principales\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-281\"}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/03/26/2\",\"source\":\"security@apache.org\"},{\"url\":\"https://github.com/apache/airflow/pull/37310\",\"source\":\"security@apache.org\"},{\"url\":\"https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/03/26/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://github.com/apache/airflow/pull/37310\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.