Advisoriesby IbisApache AirflowGHSA-xvw9-3mhm-xjqq
Apache Airflow information disclosure vulnerability
Fix: upgrade to 2.6.3 or later
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-airflow PyPI | < 2.6.3 | 2.6.3 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-200
- Also known as
- BIT-airflow-2022-46651, CVE-2022-46651, PYSEC-2023-103
- nvd.nist.gov/vuln/detail/CVE-2022-46651
- github.com/apache/airflow/pull/32309
- github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8
- github.com/apache/airflow
- github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml
- lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d
More Apache Airflow advisories
All Apache Airflow
Apache Airflow Execution with Unnecessary PrivilegesCVE-2023-39508fixed in 2.6.0b1Apache Airflow Incorrect Authorization vulnerabilityCVE-2023-35908fixed in 2.6.3Apache Airflow Improper Input Validation vulnerabilityCVE-2023-36543fixed in 2.6.3Apache Airflow Improper Input Validation vulnerabilityCVE-2023-22888fixed in 2.6.3Apache Airflow Path Traversal vulnerabilityCVE-2023-22887fixed in 2.6.3Apache Airflow vulnerable to exposure of sensitive informationCVE-2023-35005fixed in 2.6.2rc1