CVE-2024-45034

Advisory

Apache Airflow affected versions contain a potential security vulnerability in the initialization process. The DAGS_FOLDER was added to sys.path before importing local settings, potentially allowing execution of malicious code if an attacker had write access to the DAGS_FOLDER. The fix reorganizes the initialization sequence, ensuring DAGS_FOLDER is added to sys.path only after local settings are imported. This change mitigates the risk of unintended code execution during startup. Users are strongly advised to update to the latest version incorporating this fix, especially in environments where DAGS_FOLDER access is not strictly controlled.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-92xg-gmrq-5c3w
• https://github.com/apache/airflow/commit/03e01e76d2203d37aa645096df195b4328665f6d
• https://lists.apache.org/thread/b4fcw33vh60yfg9990n5vmc7sy2dcgjx
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45034