Apache AirflowGHSA-mjff-wv85-hmcj
Apache Airflow vulnerable to exposure of sensitive information
High6.5CVE-2023-35005 · Published Jun 19, 2023 · updated Nov 22, 2024
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | >= 2.5.0, < 2.6.2rc1 | 2.6.2rc1 |
Details and references
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2023-35005, CVE-2023-35005, PYSEC-2023-89
- nvd.nist.gov/vuln/detail/CVE-2023-35005
- github.com/apache/airflow/pull/31788
- github.com/apache/airflow/pull/31820
- github.com/apache/airflow/commit/5679a01919ac9d5153e858f8b1390cbc7915f148
- github.com/apache/airflow/commit/f6cda8fb63250fc4700658999739c1c3c5f6625c
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-89.yaml
- lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd
More Apache Airflow advisories
All Apache Airflow| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 122023 | Apache Airflow information disclosure vulnerability CVE-2022-46651High6.5fixed in 2.6.3 | High6.5 | 2.6.3 |
| Jul 122023 | Apache Airflow Incorrect Authorization vulnerability CVE-2023-35908High6.5fixed in 2.6.3 | High6.5 | 2.6.3 |
| Jul 122023 | Apache Airflow Improper Input Validation vulnerability CVE-2023-36543High6.5fixed in 2.6.3 | High6.5 | 2.6.3 |
| Jul 122023 | Apache Airflow Improper Input Validation vulnerability CVE-2023-22888High6.5fixed in 2.6.3 | High6.5 | 2.6.3 |
| Jul 122023 | Apache Airflow Path Traversal vulnerability CVE-2023-22887High6.5fixed in 2.6.3 | High6.5 | 2.6.3 |
| May 82023 | Apache Airflow vulnerable to Privilege Context Switching Error CVE-2023-25754Critical9.8fixed in 2.6.0b1 | Critical9.8 | 2.6.0b1 |