apache-airflow (=2.9.0b2), apache-airflow-providers-common-compat (>=1.0.0 <=1.6.0b1) potentially affected by CVE-2024-45033 via apache-airflow-providers-fab (>=1.0.2b0 <=1.4.1)

apache-airflow-providers-fab PYPI version =1.0.2b0, =1.0.0, =1.6.0b1 Source cves: CVE-2024-45033 Source advisory: OSV:GHSA-8863-4QMG-FR45...

GHSA-8863-4QMG-FR45 Apache Airflow Fab Provider Insufficient Session Expiration vulnerability

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

Apache Airflow Fab Provider Insufficient Session Expiration vulnerability

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-45033

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-45033

CVE-2024-45033 affects Apache Airflow Fab Provider prior to 1.5.2. The root cause is insufficient session expiration: after a user’s password is changed via the admin CLI, the user’s existing sessions are not cleared, allowing continued access even after password changes. This issue is CLI-specif...

CVE-2024-45033 Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

Apache Airflow 代码问题漏洞

Apache Airflow is a set of open source platforms for creating, managing and monitoring workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 1.5.2 that stems from a...

Malicious code in apache-airflow-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6c372df22c9d32de9b2be3a877474b47fc253abc67f5b69d611ebc9640559fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11941 Malicious code in apache-airflow-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6c372df22c9d32de9b2be3a877474b47fc253abc67f5b69d611ebc9640559fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the fact that it exposes information in debugging messages, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Apache Airflow lies in the exposure of information in debugging messages. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected...

Malicious code in apache-airflow-providers-edge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9db9c9532f0405358d9eba42b9f1e7702f9d5f1878e60e1d6e0d94f7154368b The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

MAL-2025-900 Malicious code in apache-airflow-providers-edge (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a9db9c9532f0405358d9eba42b9f1e7702f9d5f1878e60e1d6e0d94f7154368b The package looks like a beginning for a further work. In fact, the uploader has shortly published a few similar packages appearing to be e.g. an integration f...

Sensitive Information Disclosure

Apache Airflow is vulnerable to Sensitive Information Disclosure. The vulnerability is due to insufficient masking of sensitive configuration variables in task logs, allowing DAG authors to log such variables unintentionally or intentionally, potentially exposing them to unauthorized users...

Sensitive Data Exposure

apacheairflow is vulnerable to Sensitive Data Exposure. The vulnerability is due to sensitive variable values being logged unencrypted in audit logs when set via the CLI, which allows an attacker with audit log access to view those sensitive values...

BIT-AIRFLOW-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially...

GHSA-46C3-5XC5-WWHV Apache Airflow: Sensitive configuration values are not masked in the logs by default

Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnerability allows DAG authors to unintentionally or intentionally log sensitive configuration variables. Unauthorized users could access these logs, potentially...

aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +6 more potentially affected by CVE-2024-45784 via apache-airflow (>=2.0.0 <=2.10.3)

apache-airflow PYPI version =2.0.0, =0.1.0rc3, =0.1.0, =0.3.12, =11.8.0, =13.7.0 - gps-building-blocks =1.2.2 - neuro-airflow-plugin =0.0.1 Source cves: CVE-2024-45784 Source advisory: SNYK:PYTHON-APACHEAIRFLOW-8383109...

Insertion of Sensitive Information into Log File

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of configuration variables belonging to other DAG author users. If these variables...