github - ghsa-746v-hfh2-xphm

GHSA-746V-HFH2-XPHM

Vulnerability from github – Published: 2022-08-17 00:00 – Updated: 2023-04-13 17:53

Summary

Remote code execution in Apache Airflow Docker's Provider

Details

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.

Severity ?

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "apache-airflow-providers-docker"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-38362"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-13T17:53:42Z",
    "nvd_published_at": "2022-08-16T14:15:00Z",
    "severity": "HIGH"
  },
  "details": "Apache Airflow Docker\u0027s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host. Disable loading of example DAGs or upgrade apache-airflow-providers-docker to 3.0.0 or above.",
  "id": "GHSA-746v-hfh2-xphm",
  "modified": "2023-04-13T17:53:42Z",
  "published": "2022-08-17T00:00:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38362"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2022/08/16/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Remote code execution in Apache Airflow Docker\u0027s Provider"
}

CVE-2022-38362 (GCVE-0-2022-38362)

Vulnerability from cvelistv5 – Published: 2022-08-16 14:10 – Updated: 2024-08-03 10:54

Title

Docker Provider <3.0 RCE vulnerability in example dag

Summary

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.

Severity ?

No CVSS data available.

CWE

Remote Code Execution

Assigner

apache

References

URL

Tags

	https://lists.apache.org/thread/614p38nf4gbk8xhvn…	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2022/08/16/1	mailing-listx_refsource_MLIST

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Airflow	Affected: Apache Airflow Docker Provider , < 3.0.0 (custom)

Credits

Thanks to Kai Zhao of 3H Secruity Team for reporting this

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:54:03.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb"
          },
          {
            "name": "[oss-security] 20220816 CVE-2022-38362: Apache Airflow Docker Provider \u003c3.0 RCE vulnerability in example dag",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2022/08/16/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Airflow",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "3.0.0",
              "status": "affected",
              "version": "Apache Airflow Docker Provider",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Thanks to Kai Zhao of 3H Secruity Team for reporting this"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Apache Airflow Docker\u0027s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Remote Code Execution",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-16T20:06:13",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb"
        },
        {
          "name": "[oss-security] 20220816 CVE-2022-38362: Apache Airflow Docker Provider \u003c3.0 RCE vulnerability in example dag",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2022/08/16/1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Docker Provider \u003c3.0 RCE vulnerability in example dag",
      "workarounds": [
        {
          "lang": "en",
          "value": "Disable loading of example DAGs or upgrade the apache-airflow-providers-docker to 3.0.0 or above"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2022-38362",
          "STATE": "PUBLIC",
          "TITLE": "Docker Provider \u003c3.0 RCE vulnerability in example dag"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Airflow",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache Airflow Docker Provider",
                            "version_value": "3.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Thanks to Kai Zhao of 3H Secruity Team for reporting this"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Apache Airflow Docker\u0027s Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": [
          {}
        ],
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Remote Code Execution"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb"
            },
            {
              "name": "[oss-security] 20220816 CVE-2022-38362: Apache Airflow Docker Provider \u003c3.0 RCE vulnerability in example dag",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2022/08/16/1"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        },
        "work_around": [
          {
            "lang": "en",
            "value": "Disable loading of example DAGs or upgrade the apache-airflow-providers-docker to 3.0.0 or above"
          }
        ]
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2022-38362",
    "datePublished": "2022-08-16T14:10:09",
    "dateReserved": "2022-08-15T00:00:00",
    "dateUpdated": "2024-08-03T10:54:03.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-746V-HFH2-XPHM

CVE-2022-38362 (GCVE-0-2022-38362)

Tags

Sightings

Nomenclature