Search for packages
| purl | pkg:pypi/apache-airflow@2.5.3rc1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3h3z-bfsc-jqax
Aliases: CVE-2023-50783 PYSEC-2023-267 |
Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compromises the integrity of variable management, potentially leading to unauthorized data modification. Users are recommended to upgrade to 2.8.0, which fixes this issue |
Affected by 3 other vulnerabilities. |
|
VCID-4ga6-4111-dyc9
Aliases: CVE-2023-50944 PYSEC-2024-14 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows an authenticated user to access the source code of a DAG to which they don't have access. This vulnerability is considered low since it requires an authenticated user to exploit it. Users are recommended to upgrade to version 2.8.1, which fixes this issue. |
Affected by 1 other vulnerability. |
|
VCID-5cpd-kjpb-ekhv
Aliases: CVE-2023-42663 PYSEC-2023-197 |
Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 9 other vulnerabilities. |
|
VCID-5zmy-2ape-7qfa
Aliases: CVE-2023-40712 PYSEC-2023-171 |
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated users who have access to see the task/dag in the UI, to craft a URL, which could lead to unmasking the secret configuration of the task that otherwise would be masked in the UI. Users are strongly advised to upgrade to version 2.7.1 or later which has removed the vulnerability. |
Affected by 13 other vulnerabilities. |
|
VCID-71hr-1ews-9qa6
Aliases: CVE-2023-35908 PYSEC-2023-119 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is recommended to upgrade to a version that is not affected |
Affected by 16 other vulnerabilities. |
|
VCID-98yf-mvnw-d3b4
Aliases: CVE-2023-42781 PYSEC-2023-231 |
Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. This is a different issue than CVE-2023-42663 but leading to similar outcome. Users of Apache Airflow are advised to upgrade to version 2.7.3 or newer to mitigate the risk associated with this vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-amac-hqnj-xfgz
Aliases: CVE-2023-50943 PYSEC-2024-13 |
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue. |
Affected by 1 other vulnerability. |
|
VCID-b3w3-h9cm-ufgm
Aliases: CVE-2023-39508 PYSEC-2023-134 |
Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the webserver context as well as allows to bypas limitation of access the user has to certain DAGs. The "Run Task" feature is considered dangerous and it has been removed entirely in Airflow 2.6.0 This issue affects Apache Airflow: before 2.6.0. |
Affected by 22 other vulnerabilities. |
|
VCID-cahz-4dy7-bbe9
Aliases: CVE-2023-40273 PYSEC-2023-158 |
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user. Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there were no mechanisms to force-logout the user (and all other users with that). With this fix implemented, when using the database session backend, the existing sessions of the user are invalidated when the password of the user is reset. When using the securecookie session backend, the sessions are NOT invalidated and still require changing the secure key and restarting the webserver (and logging out all other users), but the user resetting the password is informed about it with a flash message warning displayed in the UI. Documentation is also updated explaining this behaviour. Users of Apache Airflow are advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. |
Affected by 15 other vulnerabilities. |
|
VCID-csqr-pdvv-gfbh
Aliases: CVE-2023-46288 PYSEC-2023-218 |
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0. Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2). Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348. |
Affected by 16 other vulnerabilities. |
|
VCID-dh4r-77xc-cbas
Aliases: CVE-2023-25693 PYSEC-2023-314 |
Improper Input Validation vulnerability in the Apache Airflow Sqoop Provider. This issue affects Apache Airflow Sqoop Provider versions before 3.1.1. |
Affected by 0 other vulnerabilities. |
|
VCID-ez45-qkb4-xkba
Aliases: CVE-2022-46651 PYSEC-2023-103 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability. |
Affected by 16 other vulnerabilities. |
|
VCID-fbjk-2uvy-mqfc
Aliases: CVE-2023-47037 PYSEC-2023-232 |
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.3 or later which has removed the vulnerability. |
Affected by 7 other vulnerabilities. |
|
VCID-h6sp-398p-pbeg
Aliases: CVE-2023-22887 PYSEC-2023-104 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to perform unauthorized file access outside the intended directory structure by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected |
Affected by 16 other vulnerabilities. |
|
VCID-hy75-nfg7-zfae
Aliases: CVE-2023-22888 PYSEC-2023-105 |
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an attacker to cause a service disruption by manipulating the run_id parameter. This vulnerability is considered low since it requires an authenticated user to exploit it. It is recommended to upgrade to a version that is not affected |
Affected by 16 other vulnerabilities. |
|
VCID-j86y-n37n-n7ft
Aliases: CVE-2023-48291 PYSEC-2023-265 |
Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. This is a missing fix for CVE-2023-42792 in Apache Airflow 2.7.2 Users of Apache Airflow are strongly advised to upgrade to version 2.8.0 or newer to mitigate the risk associated with this vulnerability. |
Affected by 3 other vulnerabilities. |
|
VCID-njyy-ywer-x7bf
Aliases: CVE-2023-42792 PYSEC-2023-203 |
Apache Airflow, in versions prior to 2.7.2, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to clear DAGs they shouldn't. Users of Apache Airflow are strongly advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 9 other vulnerabilities. |
|
VCID-pypb-cezm-rkb2
Aliases: CVE-2023-40611 PYSEC-2023-170 |
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could have them alter details such as configuration parameters, start date, etc. Users should upgrade to version 2.7.1 or later which has removed the vulnerability. |
Affected by 13 other vulnerabilities. |
|
VCID-q4rb-1yt3-rqdk
Aliases: CVE-2023-35005 PYSEC-2023-89 |
In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later. |
Affected by 21 other vulnerabilities. |
|
VCID-qmpd-946c-gqbc
Aliases: CVE-2023-25754 PYSEC-2023-59 |
Privilege Context Switching Error vulnerability in Apache Software Foundation Apache Airflow.This issue affects Apache Airflow: before 2.6.0. |
Affected by 22 other vulnerabilities. |
|
VCID-ryct-uaw3-fyfc
Aliases: CVE-2023-37379 PYSEC-2023-152 |
Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server. Furthermore, malicious actors can leverage this vulnerability to establish harmful connections with the server. Users of Apache Airflow are strongly advised to upgrade to version 2.7.0 or newer to mitigate the risk associated with this vulnerability. Additionally, administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface. |
Affected by 16 other vulnerabilities. |
|
VCID-suwt-h1ze-mydu
Aliases: CVE-2023-29247 PYSEC-2023-60 |
Task instance details page in the UI is vulnerable to a stored XSS.This issue affects Apache Airflow: before 2.6.0. |
Affected by 22 other vulnerabilities. |
|
VCID-t476-g5u5-1yeh
Aliases: CVE-2023-42780 PYSEC-2023-202 |
Apache Airflow, versions prior to 2.7.2, contains a security vulnerability that allows authenticated users of Airflow to list warnings for all DAGs, even if the user had no permission to see those DAGs. It would reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability. |
Affected by 9 other vulnerabilities. |
|
VCID-xh7u-8ze6-cqhk
Aliases: CVE-2023-36543 PYSEC-2023-106 |
Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request hang. It is recommended to upgrade to a version that is not affected |
Affected by 16 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||