airflow-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF GitHub Bot (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (AIRFLOW-3295) Potential Security Issue in DaskExecutor
Date Sat, 03 Nov 2018 07:37:00 GMT

    [ https://issues.apache.org/jira/browse/AIRFLOW-3295?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16673955#comment-16673955
] 

ASF GitHub Bot commented on AIRFLOW-3295:
-----------------------------------------

msumit closed pull request #4128: [AIRFLOW-3295] Fix potential security issue in DaskExecutor
URL: https://github.com/apache/incubator-airflow/pull/4128
 
 
   

This is a PR merged from a forked repository.
As GitHub hides the original diff on merge, it is displayed below for
the sake of provenance:

As this is a foreign pull request (from a fork), the diff is supplied
below (as it won't show otherwise due to GitHub magic):

diff --git a/airflow/executors/dask_executor.py b/airflow/executors/dask_executor.py
index 23c0b636b6..80527a2512 100644
--- a/airflow/executors/dask_executor.py
+++ b/airflow/executors/dask_executor.py
@@ -49,6 +49,7 @@ def start(self):
                 tls_client_key=self.tls_key,
                 tls_client_cert=self.tls_cert,
                 tls_ca_file=self.tls_ca,
+                require_encryption=True,
             )
         else:
             security = None


 

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


> Potential Security Issue in DaskExecutor
> ----------------------------------------
>
>                 Key: AIRFLOW-3295
>                 URL: https://issues.apache.org/jira/browse/AIRFLOW-3295
>             Project: Apache Airflow
>          Issue Type: Bug
>          Components: executor
>    Affects Versions: 1.10.0
>            Reporter: Xiaodong DENG
>            Assignee: Xiaodong DENG
>            Priority: Critical
>
> When user decide to use SSL encryption for DaskExecutor communications, `Distributed.Security`
object will be created.
> However, one argument (`require_encryption`) is missed to be set to `True` (its default
value is `False`). This may fail the SSL encryption setting-up.
>  
> Current implementation: [https://github.com/apache/incubator-airflow/blob/120f4856cdea5134971c4c4a239ddbfdc80db77e/airflow/executors/dask_executor.py#L48]
> Related Documentation: http://distributed.dask.org/en/latest/tls.html?highlight=require_encryption#parameters



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message