Executive brief
Apache Airflow is a popular open-source workflow orchestration platform. An authenticated user can craft malicious regex input to cause the application to hang indefinitely, disrupting scheduled job processing and administrative access. This affects all versions before 2.6.3 and requires user authentication to exploit.
Technical details
The vulnerability is an improper input validation flaw (CWE-20, CWE-1333) in Apache Airflow's regex matching logic, specifically a regular expression denial of service (ReDoS) attack. An authenticated attacker can submit carefully crafted regex patterns that cause catastrophic backtracking in Python's standard regex engine, causing the application to hang or become unresponsive. The attack requires network access to Airflow and valid authentication credentials. The fix (merged in PR #32060) involves replacing Python's standard re module with google-re2, which is resistant to ReDoS attacks. Versions 2.6.3 and later are patched.
Affected products
- Apache Airflow before 2.6.3
Timeline
- 2023-07-12: disclosed
- 2023-07-12: patched: Fix merged in PR #32060, available in version 2.6.3