Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

airflow

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5PyPIAmendedPublished

    Apache Airflow: Sensitive configuration values are not masked in the logs by default

    CVE-2024-45784 · GHSA-46c3-5xc5-wwhv

    Affected
    • PyPI airflow < 2.10.3
    Fixed in
    2.10.3· Vendor fix available
    Issue
    Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially exposing critical data that could be exploited to compromise the security of the Airflow deployment. In version 2.10.3, secrets are now masked in task logs to prevent sensitive configuration variables from being exposed in the logging output. Users should upgrade to Airflow 2.10.3 or the latest version to eliminate this vulnerability. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.

    Recommended action: Upgrade to 2.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →
  2. Medium, CVSS 4.8PyPIAmendedPublished

    Apache Airflow vulnerable to XSS and local file disclosure

    CVE-2019-12417 · GHSA-q3p4-gw7r-wqjc

    Affected
    • PyPI airflow < 1.10.6
    Fixed in
    1.10.6· Vendor fix available
    Issue
    A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript on certain page views. This also presented a Local File Disclosure vulnerability to any file readable by the webserver process.

    Recommended action: Upgrade to 1.10.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)osv.dev (2)github.com (3)Source checked Evidence →