What is CVE-2020-11982?

CVE-2020-11982 is a critical-severity vulnerability in Apache Airflow, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2020-07-17.

How severe is CVE-2020-11982?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2020-11982 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Apache Airflow

CVE-2020-11982

An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attack can connect to the broker (Redis, RabbitMQ) directly, it was possible to insert a malicious payload directly to the broker which could…

Vulnerability class: Insecure Deserialization

EPSS: 0.072 (93.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Apache Airflow
Apache Software Foundation Airflow — versions 1.10.10 and below

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

References

security@apache.org (Mailing List, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-11982?: CVE-2020-11982 is a critical-severity vulnerability in Apache Airflow, classified under Deserialization of Untrusted Data. CVSS score: 9.8/10. Published 2020-07-17.
How severe is CVE-2020-11982?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2020-11982 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.