Lee

The Edge3 provider for Apache Airflow 2 contains an issue that allows a Dag author to perform Remote Code Execution (RCE) in the webserver context through a non-public API. This API was intended for testing the Edge Provider during development and was implicitly enabled when the Edge3 provider was installed and configured on Airflow 2. The Edge3 provider support in Airflow 2 was development-only and not officially released. The issue is present only if the Edge3 provider was installed and configured on Airflow 2.

The issue is related to the exposure of sensitive information in Apache Airflow, which could allow a remote attacker to obtain confidential information.

A validation issue was addressed with improved input sanitization, allowing an application to potentially read restricted memory.

A validation issue was addressed with improved input sanitization.

A validation issue was addressed with improved input sanitization.

The issue is related to a buffer overflow in the Intel Graphics Driver component of the operating system, which can be exploited by a remote attacker to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) using a specially crafted application.