[D] PSA for CVE-2021-33026 [airflow]

["lewijw (via GitHub)" <gi...@apache.org>]

GitHub user lewijw created a discussion: PSA for CVE-2021-33026

I'm making a PSA for anyone that is concerned about CVE-2021-33026 that may appear with a scan after Airflow is installed.  It is not an actual vulnerability as far as I can tell.  First of all, with Airflow 3, flask_caching is not directly used by airflow-core or the FAB provider.  If using the FAB provider, it is being pulled down since it is a dependency of Flask, but it can be safely uninstalled.

For Airflow 2, the filesystem backend is being used:

https://github.com/apache/airflow/blob/2.10.5/airflow/www/extensions/init_cache.py#L41
https://github.com/apache/airflow/blob/2.10.5/airflow/cli/commands/internal_api_command.py#L241

As of version 2.3 of flask_caching, the filesystem backend does not use pickle.  I've asked the flask_caching team to verify:

https://github.com/pallets-eco/flask-caching/discussions/619

For safety sake, you can remove all the backends from flask_caching/backends/__init__.py except for filesystemcache.  After doing that, you can also delete the following two files that contain the word "pickle":

backend/memcache.py
backend/rediscache.py

Of course, don't take my word for it.  Verify it for yourself.

Hopefully this may help someone that has to look into this as I have recently.


GitHub link: https://github.com/apache/airflow/discussions/48443

----
This is an automatically sent email for commits@airflow.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@airflow.apache.org