CVE-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

2024-04-1807:19:05

CWE-200

apache

www.cve.org

apache airflow

vulnerability

sensitive configuration

authenticated user

webserver

ui page

community provider

workaround

cve-2024-31869

api

4.6 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.6%

JSON

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the “configuration” UI page when “non-sensitive-only” was set as “webserver.expose_config” configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your “expose_config” configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.

CNA Affected

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.8.4",
        "status": "affected",
        "version": "2.7.0",
        "versionType": "semver"
      }
    ]
  }
]