Advisoriesby IbisApache AirflowGHSA-cgx2-rrmr-jx43
Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs
Fix: upgrade to 2.7.2 or later
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.7.2 | 2.7.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2023-42780, CVE-2023-42780, PYSEC-2023-202
- nvd.nist.gov/vuln/detail/CVE-2023-42780
- github.com/apache/airflow/pull/34355
- github.com/apache/airflow/commit/cf4eb3fb9b5cf4a8369b890e39523d4c05eed161
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-202.yaml
- lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-42781fixed in 2.7.3Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilityCVE-2023-46215fixed in 2.7.0Apache Airflow vulnerable to Exposure of Sensitive InformationCVE-2023-46288fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposureCVE-2023-42663fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyCVE-2023-45348fixed in 2.7.2Apache Airflow vulnerable to privilege escalationCVE-2023-42792fixed in 2.7.2