CVE-2022-38362

Published: Aug 16, 2022Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.

Affected (1)

Products: Apache: Apache Airflow Providers Docker

Apache

1 product

Apache Airflow Providers Docker

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Apache Apache Airflow Providers Docker	Before 3.0.0

References (4)

http://www.openwall.com/lists/oss-security/2022/08/16/1

Source: security@apache.org

Third Party Advisory

https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb

Source: security@apache.org

Mailing ListVendor Advisory

http://www.openwall.com/lists/oss-security/2022/08/16/1

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.apache.org/thread/614p38nf4gbk8xhvnskj9b1sqo2dknkb

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListVendor Advisory

Timeline

No history available yet.