Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
What fixes it
- 7.0.1Apache Airflow SSH providerCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Reports 1
1 outlet mention it. Reports are not confirmation; each links to its source.
Description
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated environment parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as $(...) in a value was executed on the remote SSH host. In a Dag that passes trigger-time input such as params or dag_run.conf into environment, a user who can trigger that Dag but cannot author Dags could run arbitrary commands on the remote host as the SSH connection's user. Users are advised to upgrade apache-airflow-providers-ssh to 7.0.1 or later.
Text from CVE List
Affected versions 1
- Apache Airflow SSH provideraffected: 4.3.0 before 7.0.1CVE List