CVE-2022-38170: apache software foundation apache airflow
CVSS: 4.7v3.1MediumModified
AliasesGHSA-q8h9-pqcx-59hwBIT-airflow-2022-38170PYSEC-2022-261
Published 02-09-2022Last modified 03-08-2024
Vulnerability summary
CVE-2022-38170 is a medium (CVSS 4.7) vulnerability in apache software foundation apache airflow. EPSS estimates a 0.62% chance of exploitation in the next 30 days, higher than 48.4% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.1 (NVD)EPSS score
0.62%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 02-09-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 5.7Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 4.7Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · PypiEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.62%
Chance of exploitation in the next 30 days
Percentile
48%
Versus all other CVEs
30-day change
0.00 pp
From 0.62% on 18-09-2026
18-09-202618-10-2026
EPSS score0.62%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- airflow< 2.3.4
Apache software foundation1 product
- apache airflow≥ Apache Airflow, ≤ 2.3.3
PyPI1 product
- apache-airflow< 2.3.4
3 vendors · 3 products
References
11 links- lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzvX Refsource MISCWEBMailing ListMitigationVendor Advisory
- www.openwall.com/lists/oss-security/2022/09/02/3Mailing ListX Refsource MLISTWEBMitigationThird Party Advisory
- www.openwall.com/lists/oss-security/2022/09/02/12Mailing ListX Refsource MLISTWEBThird Party Advisory
- www.openwall.com/lists/oss-security/2022/09/21/2Mailing ListX Refsource MLISTWEBThird Party Advisory
- github.com/apache/airflowPACKAGE