GHSA-xvw9-3mhm-xjqq
Apache Airflow information disclosure vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2022-46651
- Aliases
- BIT-airflow-2022-46651, PYSEC-2023-103
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Affected packages
| Package | Versions |
|---|---|
| PyPI · apache-airflow | introduced 0, fixed 2.6.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-46651 ADVISORY
- https://github.com/apache/airflow/pull/32309 WEB
- https://github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8 WEB
- https://github.com/apache/airflow PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml WEB
- https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |