x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-39877

[GoVulnBot]

Advisory CVE-2024-39877 references a vulnerability in the following Go modules:

Module
github.com/apache/airflow

Description:
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-39877
• FIX: Disable rendering for doc_md apache/airflow#40522
• WEB: https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1

Cross references:

• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50943 #2473 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50944 #2474 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-51702 #2475 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-25141 #2570 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-27906 #2586 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-26280 #2596 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-28746 #2680 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-29735 #2681 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-31869 #2733 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-29733 #2742 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-46288 #2805 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-32077 #2835 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-25142 #2925 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/apache/airflow
      vulnerable_at: 1.8.2
summary: CVE-2024-39877 in github.com/apache/airflow
cves:
    - CVE-2024-39877
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-39877
    - fix: https://github.com/apache/airflow/pull/40522
    - web: https://lists.apache.org/thread/1xhj9dkp37d6pzn24ll2mf94wbqnb2y1
source:
    id: CVE-2024-39877
    created: 2024-07-17T09:01:14.553988078Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/599457 mentions this issue: data/excluded,data/reports: add 6 reports