Advisoriesby IbisApache AirflowGHSA-hm9r-7f84-25c9
Apache Airflow: improper authorization
Fix: upgrade to 2.7.3 or later
Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.7.3 | 2.7.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-285, CWE-863
- Also known as
- BIT-airflow-2023-47037, CVE-2023-47037, PYSEC-2023-232
- nvd.nist.gov/vuln/detail/CVE-2023-47037
- github.com/apache/airflow/pull/33413
- github.com/apache/airflow/commit/2a0106e4edf67c5905ebfcb82a6008662ae0f7ad
- github.com/apache/airflow/commit/b7a46c970d638028a4a7643ad000dcee951fb9ef
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-232.yaml
- lists.apache.org/thread/04y4vrw1t2xl030gswtctc4nt1w90cb0
- www.openwall.com/lists/oss-security/2023/11/12/1
More Apache Airflow advisories
All Apache Airflow
Apache Airflow vulnerable to Exposure of Sensitive Information to an Unauthorized ActorCVE-2023-42781fixed in 2.7.3Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerabilityCVE-2023-46215fixed in 2.7.0Apache Airflow vulnerable to Exposure of Sensitive InformationCVE-2023-46288fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposureCVE-2023-42663fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when users list warnings for all DAGsCVE-2023-42780fixed in 2.7.2Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-onlyCVE-2023-45348fixed in 2.7.2