CVE-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

🗓️ 18 Apr 2024 07:19:05Reported by apacheType

Apache Airflow vulnerability in version 2.7.0 - 2.8.4 allows viewing sensitive provider configuration on "non-sensitive-only" setting. Upgrade to 2.9 or set "expose_config" to False

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the insufficient protection of operational data, allowing attackers to gain unauthorized access to protected information.	26 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-31869	19 Apr 202416:41	–	circl
CNNVD	Apache Airflow 安全漏洞	18 Apr 202400:00	–	cnnvd
CNVD	Apache Airflow Information Disclosure Vulnerability (CNVD-2024-20804)	22 Apr 202400:00	–	cnvd
CVE	CVE-2024-31869	18 Apr 202407:19	–	cve
EUVD	EUVD-2024-1052	3 Oct 202520:07	–	euvd
Github Security Blog	Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used	18 Apr 202409:30	–	github
NVD	CVE-2024-31869	18 Apr 202408:15	–	nvd
OSV	BIT-AIRFLOW-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used	20 Apr 202407:16	–	osv
OSV	GHSA-2522-MRJC-M688 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used	18 Apr 202409:30	–	osv

[
  {
    "collectionURL": "https://pypi.python.org",
    "defaultStatus": "unaffected",
    "packageName": "apache-airflow",
    "product": "Apache Airflow",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThanOrEqual": "2.8.4",
        "status": "affected",
        "version": "2.7.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
openwall	www.openwall.com/lists/oss-security/2024/04/17/10
lists	www.lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3
github	www.github.com/apache/airflow/pull/38795

01 May 2024 18:07Current

4.6Medium risk

Vulners AI Score4.6

EPSS0.01049

CWE-200