CVE-2024-29735

5.3 · MEDIUM

Published Mar 26, 2024 apache CWE-281 EPSS 1.46% (72th pctl) CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Overview

CVE-2024-29735 is a medium-severity vulnerability affecting apache airflow. It was published on March 26, 2024 and has a CVSS 3.1 base score of 5.3 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3.

Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix group of the folders. In the case Airflow is run with the root user (not recommended) it added group write permission to all folders up to the root of the filesystem.

If your log files are stored in the home directory, these permission changes might impact your ability to run SSH operations after your home directory becomes group-writeable.

This issue does not affect users who use or extend Airflow using Official Airflow Docker reference images ( https://hub.docker.com/r/apache/airflow/ ) - those images require to have group write permission set anyway.

You are affected only if you install Airflow using local installation / virtualenv or other Docker images, but the issue has no impact if docke

Remediation

Check the references section for vendor advisories and patches from apache. Update airflow to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
apache	airflow	2.8.2	Affected

References

Ref www.openwall.com/lists/oss-security/2024/03/26/2 GitHub github.com/apache/airflow/pull/37310 Ref lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536 Ref www.openwall.com/lists/oss-security/2024/03/26/2 GitHub github.com/apache/airflow/pull/37310 Ref lists.apache.org/thread/8khb1rtbznh100o325fb8xw5wjvtv536

Frequently Asked Questions

What is CVE-2024-29735?

CVE-2024-29735 is a medium-severity vulnerability affecting apache airflow. It was published on March 26, 2024 and has a CVSS 3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2024-29735?

This vulnerability has a CVSS 3.1 base score of 5.3, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-29735?

How can CyberStrike help with CVE-2024-29735?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-29735 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719