GHSA-mjqh-v5f2-g2mw
Apache Airflow information exposure vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2023-40712
- Aliases
- BIT-airflow-2023-40712, PYSEC-2023-171
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 2.7.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-40712 ADVISORY
- https://github.com/apache/airflow/pull/33512 WEB
- https://github.com/apache/airflow/pull/33516 WEB
- https://github.com/apache/airflow/commit/4390524a41fdfd2d57f1d2dc98ad7b4009c8399e WEB
- https://github.com/apache/airflow/commit/d9814eb3a2fc1dbbb885a0a2c1b7a23ce1cfa148 WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-171.yaml WEB
- https://lists.apache.org/thread/jw1yv4lt6hpowqbb0x4o3tdp0jhx2bts WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |