GHSA-mjff-wv85-hmcj
Apache Airflow vulnerable to exposure of sensitive information
At a glance
- Published
- Updated
- CVE
- CVE-2023-35005
- Aliases
- BIT-airflow-2023-35005, PYSEC-2023-89
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 2.5.0, fixed 2.6.2rc1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-35005 ADVISORY
- https://github.com/apache/airflow/pull/31788 WEB
- https://github.com/apache/airflow/pull/31820 WEB
- https://github.com/apache/airflow/commit/5679a01919ac9d5153e858f8b1390cbc7915f148 WEB
- https://github.com/apache/airflow/commit/f6cda8fb63250fc4700658999739c1c3c5f6625c WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-89.yaml WEB
- https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |