airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17836 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17836 Source advisory: GHSA-9GQG-3FXR-9HV7...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17836 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17836 Source advisory: OSV:GHSA-9GQG-3FXR-9HV7...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17836 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17836 Source advisory: OSV:PYSEC-2019-149...

CVE-2017-17836

In Apache Airflow 1.8.2 and earlier, an experimental feature exposed authenticated cookies and passwords to databases used by Airflow. The vulnerability allows an attacker with limited access to Airflow—e.g., via XSS or an unlocked machine—to exfiltrate credentials from the system. Documented ref...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17836 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17836 Source advisory: MEND:CVE-2017-17836...