CVE-2022-38170 - Vulnerability Details - OpenCVE

In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00294.

Key SSVC decision points have not yet been added.

Vendors	Products
Apache	Airflow

Configuration 1 [-]

cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-0008	In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Github GHSA	GHSA-q8h9-pqcx-59hw	Apache Airflow exposes arbitrary file content

Fixes

Solution

No solution given by the vendor.

Workaround

Run without the `--daemon` flag via a process supervisor instead (systemd, runit, etc.).

References

Link	Providers
http://www.openwall.com/lists/oss-security/2022/09/02/12
http://www.openwall.com/lists/oss-security/2022/09/02/3
http://www.openwall.com/lists/oss-security/2022/09/21/2
https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv

History

No history.

MITRE

Status: PUBLISHED

Assigner: apache

Published: 2022-09-02T07:10:21

Updated: 2024-08-03T10:45:52.810Z

Reserved: 2022-08-11T00:00:00

Link: CVE-2022-38170

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-09-02T07:15:07.833

Modified: 2024-11-21T07:15:55.980

Link: CVE-2022-38170

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Apache Airflow", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "2.3.3", "status": "affected", "version": "Apache Airflow", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue."}], "descriptions": [{"lang": "en", "value": "In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver."}], "problemTypes": [{"descriptions": [{"description": "Overly permissive umask for deamons", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-09-21T11:06:07", "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv"}, {"name": "[oss-security] 20220902 CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/3"}, {"name": "[oss-security] 20220902 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/12"}, {"name": "[oss-security] 20220920 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2022/09/21/2"}], "source": {"discovery": "UNKNOWN"}, "title": "Overly permissive umask for daemons", "workarounds": [{"lang": "en", "value": "Run without the `--daemon` flag via a process supervisor instead (systemd, runit, etc.)."}], "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@apache.org", "ID": "CVE-2022-38170", "STATE": "PUBLIC", "TITLE": "Overly permissive umask for daemons"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Apache Airflow", "version": {"version_data": [{"version_affected": "<=", "version_name": "Apache Airflow", "version_value": "2.3.3"}]}}]}, "vendor_name": "Apache Software Foundation"}]}}, "credit": [{"lang": "eng", "value": "The Apache Airflow PMC would like to thank Harry Sintonen for reporting this issue."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": [{}], "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Overly permissive umask for deamons"}]}]}, "references": {"reference_data": [{"name": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv", "refsource": "MISC", "url": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv"}, {"name": "[oss-security] 20220902 CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/09/02/3"}, {"name": "[oss-security] 20220902 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/09/02/12"}, {"name": "[oss-security] 20220920 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2022/09/21/2"}]}, "source": {"discovery": "UNKNOWN"}, "work_around": [{"lang": "en", "value": "Run without the `--daemon` flag via a process supervisor instead (systemd, runit, etc.)."}]}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:45:52.810Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv"}, {"name": "[oss-security] 20220902 CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/3"}, {"name": "[oss-security] 20220902 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/12"}, {"name": "[oss-security] 20220920 Re: CVE-2022-38170: Apache Airflow: Overly permissive umask for deamons", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2022/09/21/2"}]}]}, "cveMetadata": {"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "assignerShortName": "apache", "cveId": "CVE-2022-38170", "datePublished": "2022-09-02T07:10:21", "dateReserved": "2022-08-11T00:00:00", "dateUpdated": "2024-08-03T10:45:52.810Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*", "matchCriteriaId": "FAFEE08F-9E2C-434B-B67A-6183062070BE", "versionEndExcluding": "2.3.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver."}, {"lang": "es", "value": "En Apache Airflow versiones anteriores a 2.3.4, era configurado una m\u00e1scara de usuario no segura para numerosos componentes de Airflow cuando es ejecutado con el flag \"--daemon\", lo que pod\u00eda resultar en una condici\u00f3n de carrera que daba lugar a archivos de escritura mundial en el directorio principal de Airflow y permit\u00eda a usuarios locales exponer contenidos de archivos arbitrarios por medio del servidor web"}], "id": "CVE-2022-38170", "lastModified": "2024-11-21T07:15:55.980", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-09-02T07:15:07.833", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/12"}, {"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/3"}, {"source": "security@apache.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/21/2"}, {"source": "security@apache.org", "tags": ["Mailing List", "Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/02/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2022/09/21/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Mitigation", "Vendor Advisory"], "url": "https://lists.apache.org/thread/zn8mbbb1j2od5nc9zhrvb7rpsrg1vvzv"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-732"}], "source": "nvd@nist.gov", "type": "Primary"}]}