Apache Airflow: Sensitive configuration values are not masked in the logs by default

🗓️ 15 Nov 2024 09:32:29Reported by GitHub Advisory DatabaseType

Sensitive configuration values not masked in logs before Airflow 2.10.

Reporter	Title	Published	Views	Family All 19
BDU FSTEC	The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the fact that it exposes information in debugging messages, allowing attackers to gain unauthorized access to protected information.	9 Dec 202400:00	–	bdu_fstec
Circl	CVE-2024-45784	15 Nov 202408:27	–	circl
CNNVD	Apache Airflow 安全漏洞	15 Nov 202400:00	–	cnnvd
CVE	CVE-2024-45784	15 Nov 202408:20	–	cve
Cvelist	CVE-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default	15 Nov 202408:20	–	cvelist
Hacker One	Internet Bug Bounty: Apache Airflow: Sensitive Information Exposure in DAG Run Logs	7 Nov 202408:50	–	hackerone
NVD	CVE-2024-45784	15 Nov 202409:15	–	nvd
OSV	BIT-AIRFLOW-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default	19 Nov 202407:07	–	osv
OSV	GHSA-46C3-5XC5-WWHV Apache Airflow: Sensitive configuration values are not masked in the logs by default	15 Nov 202409:32	–	osv
OSV	PYSEC-2024-182	15 Nov 202409:15	–	osv

Vulners

Node

apache airflowRange<2.10.3pip

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-45784
github	www.github.com/apache/airflow/pull/43040
lists	www.lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h
github	www.github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-182.yaml
openwall	www.openwall.com/lists/oss-security/2024/11/15/1
github	www.github.com/advisories/GHSA-46c3-5xc5-wwhv

21 Jan 2025 17:59Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.17.5

EPSS0.01295

SSVC