x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-32077

[GoVulnBot]

CVE-2024-32077 references github.com/apache/airflow, which may be a Go module.

Description:
Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. 
Users are recommended to upgrade to version 2.9.1, which fixes this issue.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-32077
• JSON: https://github.com/CVEProject/cvelist/tree/2bde95bc146e5f89f8757688235f4c71b2abeb64/2024/32xxx/CVE-2024-32077.json
• fix: Fix problem that links in legacy log view can not be clicked apache/airflow#38882
• web: https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
• Imported by: https://pkg.go.dev/github.com/apache/airflow?tab=importedby

Cross references:

• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50943 #2473 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50944 #2474 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-51702 #2475 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-27906 #2586 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-26280 #2596 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-28746 #2680 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-29735 #2681 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/apache/airflow
      vulnerable_at: 1.8.2
      packages:
        - package: Apache Airflow
summary: CVE-2024-32077 in github.com/apache/airflow
cves:
    - CVE-2024-32077
references:
    - fix: https://github.com/apache/airflow/pull/38882
    - web: https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77
source:
    id: CVE-2024-32077

[gopherbot]

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports