Moole Vulnerability Database

Find real vulnerabilities before they ship

High

CVE-2022-38362

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.

VectorNETWORK

PublishedAug 16, 2022, 14:15

Published Bysecurity@apache.org

Base Score

Score8.8

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

apache-airflow-providers-docker(PyPI)03.0.0N/A

References

http://www.openwall.com/lists/oss-security/2022/08/16/1
https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb

Weakness Type

NVD-CWE-noinfo

CVSS Metrics

Base Score

8.8

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Base SeverityHigh

Version

3.1

Attack Vector (AV)

NETWORK