Improper Preservation of Permissions vulnerability in Apache Airflow

CVE-2024-29735

Summary

An improper preservation of permissions vulnerability exists in Apache Airflow versions 2.8.2 through 2.8.3 due to incorrect permission settings for parent directories of the log folder. This vulnerability can inadvertently allow write access to the Unix group of these directories, particularly if Airflow is executed with elevated root access. Users storing log files in their home directory may find their systems affected during SSH operations, as home directories can become group-writable. This issue is mitigated for users running containers with the official Airflow Docker images or those with a predefined umask of 002. Recommended mitigation includes upgrading to Apache Airflow 2.8.4 or adjusting the file task handler's permissions.

References