[variant] ROOT=/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle
[variant] VULN_VENV=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv
[variant] FIXED_VENV=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv
[variant] Reusing apache-airflow==3.2.2
2026-07-07T22:43:22.776754Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:43:22.776913Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:43:22.776974Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:43:22.777031Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:43:22.777100Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37
2026-07-07T22:43:22.777166Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37
[variant] airflow_version 3.2.2
[variant] airflow_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/__init__.py
[variant] BaseSerialization.deserialize /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/serialization/serialized_objects.py 619
[variant] Reusing apache-airflow==3.3.0
[variant] airflow_version 3.3.0
[variant] airflow_file /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/__init__.py
[variant] BaseSerialization.deserialize /data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/serialization/serialized_objects.py 615
[variant] Running attempt label=airflow_exc_3.2.2_variant version=3.2.2 port=18211
{
  "variant_name": "AIRFLOW_EXC_SER serialized DAG field import_string class path",
  "airflow_version_expected": "3.2.2",
  "dag_id": "ghsa_2943_airflow_exc_variant_3_2_2",
  "port": 18211,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.2.2_variant/airflow_home",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.2.2_variant/api_server_airflow_exc_marker.txt",
  "endpoint_url": "http://127.0.0.1:18211/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_2_2?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "200",
  "import_side_effect_observed": true,
  "exception_type": null,
  "exception_message": null,
  "source_identity_fragment": "{\"airflow_version\": \"3.2.2\", \"airflow_file\": \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/__init__.py\", \"python\": \"3.14.4 (main, Apr  8 2026, 04:02:31) [GCC 15.2.0]\"}",
  "seed_stdout": "2026-07-07T22:43:29.598213Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:29.598378Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:29.598464Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:29.598530Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:29.598599Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:29.598671Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n{\n  \"seeded_dag_id\": \"ghsa_2943_airflow_exc_variant_3_2_2\",\n  \"dag_version_id\": \"019f3ec0-2d5f-7a7e-b4df-0de50ac3ed61\",\n  \"serialized_default_args\": {\n    \"__type\": \"airflow_exc_ser\",\n    \"__var\": {\n      \"__type\": \"dict\",\n      \"__var\": {\n        \"exc_cls_name\": \"evil_exception_module.EvilException\",\n        \"args\": [],\n        \"kwargs\": {\n          \"__type\": \"dict\",\n          \"__var\": {\n            \"origin\": \"serialized_dag_default_args\"\n          }\n        }\n      }\n    }\n  }\n}\n",
  "seed_stderr_tail": "",
  "api_server_pid": 17578,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "[{\"id\":\"t1\",\"label\":\"t1\"}]",
  "http_headers_excerpt": "HTTP/1.1 200 OK\ndate: Tue, 07 Jul 2026 22:43:32 GMT\nserver: uvicorn\ncontent-length: 26\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "marker_content": "AIRFLOW_EXC_SER import-time code execution in Airflow API server; pid=17578\n",
  "server_log_tail": "FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=605\n2026-07-07T22:43:30.845090Z [warning  ] FileType is deprecated. Simply open files after parsing arguments. [py.warnings] category=PendingDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=816\n2026-07-07T22:43:30.876061Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:30.876151Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:30.876193Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:30.876222Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:30.876249Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:30.876276Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18211\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:43:32.399672Z [info     ] Started server process [17578] [uvicorn.error] loc=server.py:91\n2026-07-07T22:43:32.399777Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:43:32.400341Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:43:32.401230Z [info     ] Uvicorn running on http://127.0.0.1:18211 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:43:33.296927Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:43:33.553851Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:43:33.555017Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_product_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:43:33.565832Z [info     ] request finished               [http.access] client_addr=127.0.0.1:56292 duration_us=12214 loc=http_access_log.py:98 method=GET path=/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_2_2 query='offset=0&limit=100' status_code=200\n2026-07-07T22:43:33.642763Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:43:33.743294Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:43:33.743799Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:43:33.743910Z [info     ] Finished server process [17578] [uvicorn.error] loc=server.py:101\n"
}
[variant] Running attempt label=airflow_exc_3.3.0_variant version=3.3.0 port=18212
{
  "variant_name": "AIRFLOW_EXC_SER serialized DAG field import_string class path",
  "airflow_version_expected": "3.3.0",
  "dag_id": "ghsa_2943_airflow_exc_variant_3_3_0",
  "port": 18212,
  "airflow_home": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.3.0_variant/airflow_home",
  "marker": "/data/pruva/runs/e6d20256-b0e8-49c3-a908-a69cffcc1535/bundle/vuln_variant/artifacts/airflow_exc_3.3.0_variant/api_server_airflow_exc_marker.txt",
  "endpoint_url": "http://127.0.0.1:18212/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_3_0?offset=0&limit=100",
  "service_started": true,
  "healthcheck_passed": true,
  "target_reached": true,
  "http_status": "200",
  "import_side_effect_observed": true,
  "exception_type": null,
  "exception_message": null,
  "source_identity_fragment": "{\"airflow_version\": \"3.3.0\", \"airflow_file\": \"/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/__init__.py\", \"python\": \"3.14.4 (main, Apr  8 2026, 04:02:31) [GCC 15.2.0]\"}",
  "seed_stdout": "{\n  \"seeded_dag_id\": \"ghsa_2943_airflow_exc_variant_3_3_0\",\n  \"dag_version_id\": \"019f3ec0-5308-7ba7-803a-f41631ce3ac0\",\n  \"serialized_default_args\": {\n    \"__type\": \"airflow_exc_ser\",\n    \"__var\": {\n      \"__type\": \"dict\",\n      \"__var\": {\n        \"exc_cls_name\": \"evil_exception_module.EvilException\",\n        \"args\": [],\n        \"kwargs\": {\n          \"__type\": \"dict\",\n          \"__var\": {\n            \"origin\": \"serialized_dag_default_args\"\n          }\n        }\n      }\n    }\n  }\n}\n",
  "seed_stderr_tail": "",
  "api_server_pid": 17602,
  "health_http_status": "200",
  "curl_stderr": "",
  "http_response_excerpt": "[{\"id\":\"t1\",\"label\":\"t1\"}]",
  "http_headers_excerpt": "HTTP/1.1 200 OK\ndate: Tue, 07 Jul 2026 22:43:42 GMT\nserver: uvicorn\ncontent-length: 26\ncontent-type: application/json\nvary: Accept-Encoding\n\n",
  "api_server_returncode": 0,
  "marker_content": "AIRFLOW_EXC_SER import-time code execution in Airflow API server; pid=17602\n",
  "server_log_tail": "ilename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/cli/cli_config.py lineno=868\n2026-07-07T22:43:40.854173Z [info     ] setup plugin alembic.autogenerate.schemas [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854302Z [info     ] setup plugin alembic.autogenerate.tables [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854383Z [info     ] setup plugin alembic.autogenerate.types [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854450Z [info     ] setup plugin alembic.autogenerate.constraints [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854520Z [info     ] setup plugin alembic.autogenerate.defaults [alembic.runtime.plugins] loc=plugins.py:37\n2026-07-07T22:43:40.854561Z [info     ] setup plugin alembic.autogenerate.comments [alembic.runtime.plugins] loc=plugins.py:37\n  ____________       _____________\n ____    |__( )_________  __/__  /________      __\n____  /| |_  /__  ___/_  /_ __  /_  __ \\_ | /| / /\n___  ___ |  / _  /   _  __/ _  / / /_/ /_ |/ |/ /\n _/_/  |_/_/  /_/    /_/    /_/  \\____/____/|__/\nRunning the API server with uvicorn:\nApps: all\nWorkers: 1\nHost: 127.0.0.1:18212\nTimeout: 120\nLogfiles: -\n=================================================================\n2026-07-07T22:43:41.252393Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/common/exceptions.py lineno=132\n2026-07-07T22:43:41.348713Z [warning  ] 'HTTP_422_UNPROCESSABLE_ENTITY' is deprecated. Use 'HTTP_422_UNPROCESSABLE_CONTENT' instead. [py.warnings] category=StarletteDeprecationWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/airflow/api_fastapi/core_api/routes/public/__init__.py lineno=29\n2026-07-07T22:43:42.588326Z [info     ] Started server process [17602] [uvicorn.error] loc=server.py:91\n2026-07-07T22:43:42.588466Z [info     ] Waiting for application startup. [uvicorn.error] loc=on.py:48\n2026-07-07T22:43:42.589132Z [info     ] Application startup complete.  [uvicorn.error] loc=on.py:62\n2026-07-07T22:43:42.590538Z [info     ] Uvicorn running on http://127.0.0.1:18212 (Press CTRL+C to quit) [uvicorn.error] loc=server.py:222\n2026-07-07T22:43:42.975107Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=147\n2026-07-07T22:43:42.985523Z [warning  ] The HMAC key is 24 bytes long, which is below the minimum recommended length of 64 bytes for SHA512. See RFC 7518 Section 3.2. [py.warnings] category=InsecureKeyLengthWarning filename=/data/pruva/project-cache/03610ec6-e6fb-4086-9681-103dd9199da6/repo/airflow_3.3.0_cve_2026_33264_venv/lib/python3.14/site-packages/jwt/api_jwt.py lineno=368\n2026-07-07T22:43:42.996486Z [info     ] request finished               [http.access] client_addr=127.0.0.1:39394 duration_us=11946 loc=http_access_log.py:130 method=GET path=/ui/grid/structure/ghsa_2943_airflow_exc_variant_3_3_0 query='offset=0&limit=100' status_code=200\n2026-07-07T22:43:43.092345Z [info     ] Shutting down                  [uvicorn.error] loc=server.py:270\n2026-07-07T22:43:43.193127Z [info     ] Waiting for application shutdown. [uvicorn.error] loc=on.py:67\n2026-07-07T22:43:43.193738Z [info     ] Application shutdown complete. [uvicorn.error] loc=on.py:76\n2026-07-07T22:43:43.193860Z [info     ] Finished server process [17602] [uvicorn.error] loc=server.py:101\n"
}
[variant] vuln_ok=True fixed_ok=True confirmed_bypass=True
[variant] RESULT: CONFIRMED BYPASS - Airflow 3.3.0 still imports attacker-controlled AIRFLOW_EXC_SER exc_cls_name during serialized DAG deserialization.