GHSA-fvw2-2pf7-77vw
Apache Airflow subject to Exposure of Sensitive Information
At a glance
- Published
- Updated
- CVE
- CVE-2022-27949
- Aliases
- BIT-airflow-2022-27949, PYSEC-2022-42981
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 2.3.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-27949 ADVISORY
- https://github.com/apache/airflow/pull/22754 WEB
- https://github.com/apache/airflow/commit/09be0c5c7e847dda1d0be5776f8d5e327ff2281a WEB
- https://github.com/apache/airflow/commit/1cbb0ad26dd17f218c6ab1c2ae59b262c443a443 WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42981.yaml WEB
- https://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p WEB
- http://www.openwall.com/lists/oss-security/2022/11/14/3 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |