CVE-2024-29735

Advisory

Affected versions of Apache Airflow are vulnerable to an improper preservation of permissions vulnerability. This issue causes the local file task handler to incorrectly set write permissions on all parent folders of the log directory, potentially exposing sensitive directories and disrupting SSH operations when logs reside in home directories. The attack vector exploits misconfigured permission settings in non-containerized deployments, especially when running as root with a restrictive umask. Mitigation involves upgrading to Apache Airflow 2.8.4, using a non-root user, or changing the file_task_handler_new_folder_permissions configuration to 0o755.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/apache/airflow/pull/37310
• https://github.com/apache/airflow/pull/37310/commits/89c08356e775e98673a284085d82ce35e0338491
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29735