Advisoriesby IbisApache AirflowGHSA-666g-rfc5-c9jv
Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability
Fix: upgrade to 2.7.0 or later
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.
Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Note: the vulnerability is about the information exposed in the logs not about accessing the logs.
This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.
Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 1.10.0, < 2.7.0 | 2.7.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-532
- Also known as
- BIT-airflow-2023-46215, CVE-2023-46215, PYSEC-2026-1131, PYSEC-2026-2364
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-42781fixed in 2.7.3Apache Airflow vulnerable to Exposure of Sensitive InformationCVE-2023-46288fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposureCVE-2023-42663fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGsCVE-2023-42780fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyCVE-2023-45348fixed in 2.7.2Apache Airflow vulnerable to privilege escalationCVE-2023-42792fixed in 2.7.2