GHSA-J857-2PWM-JJMM vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-J857-2PWM-JJMM vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-50378 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-50378 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-50378

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

CVE-2024-50378

This CVE (CVE-2024-50378) affects Apache Airflow versions before 2.10.3. The root cause is that when sensitive variables are set via the Airflow CLI, their values were written to audit logs and stored unencrypted in the Airflow database, making them accessible to authenticated users with audit lo...

CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli

Airflow versions before 2.10.3 have a vulnerability that allows authenticated users with audit log access to see sensitive values in audit logs which they should not see. When sensitive variables were set via airflow CLI, values of those variables appeared in the audit log and were stored...

PT-2024-34168

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3 Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI,...

Apache Airflow 安全漏洞

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache USA Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 2.10.3, which stems from a vulnerabili...

Internet Bug Bounty: Apache Airflow: Sensitive Information Exposure in DAG Run Logs

The Apache Airflow platform was vulnerable to sensitive information exposure in DAG run logs. Passwords, secrets, and the Fernet key were logged in plain text, which could have resulted in the disclosure of this sensitive information to unauthorized users...

Internet Bug Bounty: Secrets not masked in UI when sensitive variables are set via Airflow cli

A vulnerability was discovered in Apache Airflow where sensitive variables set using the Airflow CLI were not properly masked in the UI, specifically in the Audit logs page. This issue was addressed in the 2.10.3 release of Apache Airflow...

GHSA-5VVG-PVHP-HV2M vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-49750 vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-HGJP-83M4-H4FJ vulnerabilities

Vulnerabilities for packages: airflow...

GHSA-HGJP-83M4-H4FJ vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-21272 vulnerabilities

Vulnerabilities for packages: airflow...

CVE-2024-21272 vulnerabilities

Vulnerabilities for packages: airflow...

Improper Encoding (Escaping Of Output)

Apache Airflow is vulnerable to Improper Encoding Escaping of Output. The vulnerability is due to the example DAG exampleinleteventextra.py allowing authenticated attackers with DAG trigger permissions to execute arbitrary commands...