CVE-2021-38540: Apache Airflow: Variable Import endpoint missed authentication check

[Kaxil Naik <kaxilnaik () apache org>]

Description:

The variable import endpoint was not protected by authentication in Airflow >=2.0.0, <2.1.3. This allowed 
unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially
resulting in a denial of service, information disclosure or remote code execution.

This issue affects Apache Airflow >=2.0.0, <2.1.3.

Credit:

Apache Airflow would like to thank Nathan Jones, National Australia Bank’s Offensive Security Team