Apache Airflow Google provider vulnerabilities
4 known vulnerabilities in Apache Airflow Google provider from Apache. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.1 High severity
Apache Airflow Google provider: Improper Limitation of a Pathname to a Restricted Directory
Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem path without normalisation or containment check. A user with w
- 8.1 High severity
Apache Airflow Google provider: Key Exchange without Entity Authentication
Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advis
- 7.5 High severity
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.
- 9.8 Critical severity
Improper Input Validation vulnerability in the Apache Airflow Google Provider.
Improper Input Validation vulnerability in the Apache Airflow Google Provider. This issue affects Apache Airflow Google Provider versions before 8.10.0.