Advisoriesby IbisApache AirflowGHSA-mjff-wv85-hmcj
Apache Airflow vulnerable to exposure of sensitive information
Fix: upgrade to 2.6.2rc1 or later
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.
This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if [webserver] expose_config is set to non-sensitive-only), and not all uncensored values are actually sentitive.
This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 2.5.0, < 2.6.2rc1 | 2.6.2rc1 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2023-35005, CVE-2023-35005, PYSEC-2023-89
- nvd.nist.gov/vuln/detail/CVE-2023-35005
- github.com/apache/airflow/pull/31788
- github.com/apache/airflow/pull/31820
- github.com/apache/airflow/commit/5679a01919ac9d5153e858f8b1390cbc7915f148
- github.com/apache/airflow/commit/f6cda8fb63250fc4700658999739c1c3c5f6625c
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-89.yaml
- lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
More Apache Airflow advisories
All Apache Airflow
Apache Airflow Path Traversal vulnerabilityCVE-2023-22887fixed in 2.6.3Apache Airflow Improper Input Validation vulnerabilityCVE-2023-22888fixed in 2.6.3Apache Airflow Improper Input Validation vulnerabilityCVE-2023-36543fixed in 2.6.3Apache Airflow Incorrect Authorization vulnerabilityCVE-2023-35908fixed in 2.6.3Apache Airflow information disclosure vulnerabilityCVE-2022-46651fixed in 2.6.3Apache Airflow vulnerable to Privilege Context Switching ErrorCVE-2023-25754fixed in 2.6.0b1