Advisoriesby IbisApache AirflowGHSA-fvw2-2pf7-77vw
Apache Airflow subject to Exposure of Sensitive Information
Fix: upgrade to 2.3.1 or later
A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.3.1 | 2.3.1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2022-27949, CVE-2022-27949, PYSEC-2022-42981
- nvd.nist.gov/vuln/detail/CVE-2022-27949
- github.com/apache/airflow/pull/22754
- github.com/apache/airflow/commit/09be0c5c7e847dda1d0be5776f8d5e327ff2281a
- github.com/apache/airflow/commit/1cbb0ad26dd17f218c6ab1c2ae59b262c443a443
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42981.yaml
- lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p
- www.openwall.com/lists/oss-security/2022/11/14/3
More Apache Airflow advisories
All Apache Airflow
OS Command Injection in Apache AirflowCVE-2022-40189fixed in 2.3.0OS Command Injection in Apache AirflowCVE-2022-38649fixed in 2.3.0OS Command Injection in Apache AirflowCVE-2022-40954fixed in 2.3.0Apache Airflow Contains Open RedirectCVE-2022-45402fixed in 2.4.3Apache Airflow vulnerable to OS Command Injection via example DAGsCVE-2022-40127fixed in 2.4.0Apache Airflow Cross-site Scripting vulnerabilityCVE-2022-43982fixed in 2.4.2rc1