Apache AirflowGHSA-cgx2-rrmr-jx43
Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGs
Medium6.5CVE-2023-42780 · Published Oct 14, 2023 · updated Sep 3, 2024
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.7.2 | 2.7.2 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2023-42780, CVE-2023-42780, PYSEC-2023-202
- nvd.nist.gov/vuln/detail/CVE-2023-42780
- github.com/apache/airflow/pull/34355
- github.com/apache/airflow/commit/cf4eb3fb9b5cf4a8369b890e39523d4c05eed161
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-202.yaml
- lists.apache.org/thread/h5tvsvov8j55wojt5sojdprs05oby34d
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Nov 122023 | Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized Actor High6.5Nov 12, 2023 | High6.5 | 2.7.3 |
| Oct 282023 | Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilityHigh7.5Oct 28, 2023 | High7.5 | 2.7.0 |
| Oct 232023 | Apache Airflow vulnerable to Exposure of Sensitive InformationMedium4.3Oct 23, 2023 | Medium4.3 | 2.7.2 |
| Oct 142023 | Apache Airflow vulnerable to sensitive information exposureMedium6.5Oct 14, 2023 | Medium6.5 | 2.7.2 |
| Oct 142023 | Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyMedium4.3Oct 14, 2023 | Medium4.3 | 2.7.2 |
| Oct 142023 | Apache Airflow vulnerable to privilege escalationMedium6.5Oct 14, 2023 | Medium6.5 | 2.7.2 |