Is CVE-2020-11978 exploited in the wild?

Yes. CVE-2020-11978 is known to be exploited in the wild, first recorded on 18 January 2022. Treat it as urgent.

How severe is CVE-2020-11978?

Critical severity, with a CVSS score of 3.1, published 17 July 2020.

Which products and versions are affected?

apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.10.11rc1.

Is there a fix for CVE-2020-11978?

Yes. apache-airflow (PyPI): upgrade to 1.10.11rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-11978 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-11978?

Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-11978: Remote code execution (RCE) in Apache Airflow

CVE-2020-11978 · Severity: critical · CVSS 3.1 · Exploited in the wild · Published 2020-07-17

A remote command injection vulnerability exists in an example DAG shipped with Apache Airflow versions 1.10.10 and below. Authenticated users can execute arbitrary commands as the user running the Airflow worker or scheduler. The vulnerability is only present if example DAGs are enabled (load_examples=True).

Technologies: Apache Airflow, apache-airflow (PyPI). Vendors: Apache, PyPI.

Quick answers

Is CVE-2020-11978 exploited in the wild?: Yes. CVE-2020-11978 is known to be exploited in the wild, first recorded on 18 January 2022. Treat it as urgent.
How severe is CVE-2020-11978?: Critical severity, with a CVSS score of 3.1, published 17 July 2020.
Which products and versions are affected?: apache-airflow (PyPI) ECOSYSTEM:introduced=0,fixed=1.10.11rc1.
Is there a fix for CVE-2020-11978?: Yes. apache-airflow (PyPI): upgrade to 1.10.11rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-11978 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-11978?: Check whether you run Apache Airflow or apache-airflow (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow (PyPI): upgrade to 1.10.11rc1 or later
```
pip install "apache-airflow>=1.10.11rc1"
```

Affected products

Apache Airflow <= 1.10.10

Identifiers

CVE-2020-11978
GHSA-rvmq-4x66-q7j3
PYSEC-2020-14

Timeline

2020-07-16: disclosed: NVD Published Date
2022-01-18: kev added: Added to CISA Known Exploited Vulnerabilities Catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.