AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache AirflowGHSA-5ff8-7639-6v6g

Apache Airflow Session Fixation vulnerability

Apache Airflow

CVE-2022-38054 · Published Sep 3, 2022 · updated Sep 11, 2024

Critical9.8
Fix: upgrade to 2.3.4rc1 or later
GitHub advisory

In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation.

Affected versions

PackageAffectedFixed in
apache-airflow
PyPI
>= 2.2.4, < 2.3.4rc12.3.4rc1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-384
Also known as
BIT-airflow-2022-38054, CVE-2022-38054, PYSEC-2022-263

More Apache Airflow advisories

All Apache Airflow
Medium 6.1Nov 2, 2022Apache Airflow Cross-site Scripting vulnerabilityCVE-2022-43982fixed in 2.4.2rc1Medium 6.1Nov 2, 2022Apache Airflow Open Redirect vulnerabilityCVE-2022-43985fixed in 2.4.2rc1High 8.1Oct 7, 2022Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or APICVE-2022-41672fixed in 2.4.1rc1High 7.5Sep 22, 2022Apache Airflow vulnerable to Use of Externally-Controlled Format StringCVE-2022-40604fixed in 2.4.0rc1Medium 6.1Sep 22, 2022Apache Airflow contains open redirectCVE-2022-40754fixed in 2.4.0rc1Medium 4.7Sep 3, 2022Apache Airflow exposes arbitrary file contentCVE-2022-38170fixed in 2.3.4