CVE-2020-13927: Vulnerability in Bitnami Airflow
Summary
CVE-2020-13927: The previous default setting for Airflow's Experimental API was to allow all API requests without authentication, but this poses security risks to users who miss this fact. Affects airflow versions < 1.10.11. Fixed in 1.10.11. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2020-13927 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bitnami Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, manage, and monitor complex workflows as directed acyclic graphs (DAGs). This vulnerability affects Bitnami Airflow versions prior to 1.10.11.
Vulnerability Detail
The previous default setting for Airflow's Experimental API allowed all API requests without authentication, posing security risks to users who were unaware of this. An attacker could exploit this vulnerability to gain unauthorized access to sensitive data or perform malicious actions on the Airflow instance. To address this issue, the default behavior has been changed in Airflow 1.10.11 to deny all requests by default.
How To Fix
Minimum fixed version
1.10.11
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the issue.
Conclusion
In conclusion, Bitnami Airflow versions prior to 1.10.11 are vulnerable to unauthorized API access. Users should update their configuration to deny all requests by default. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Bitnami Airflow is an open-source platform used for orchestrating and scheduling workflows. It allows users to define, manage, and monitor complex workflows as directed acyclic graphs (DAGs).
This vulnerability allows unauthorized access to the Airflow instance, potentially leading to the exposure of sensitive data or the execution of malicious actions.
Bitnami Airflow versions prior to 1.10.11 are affected by this vulnerability.
To fix this vulnerability, existing users of Bitnami Airflow need to update their configuration file and set the [api]auth_backend parameter to airflow.api.auth.backend.deny_all.
There is no specific workaround for this vulnerability. It is recommended to follow the steps mentioned in the 'how_to_fix' section to mitigate the issue.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
