airflow-docker (>=0.1.1, <=0.5.0), airflow-imaging-plugins (>=2.4.2, <=2.4.3) +9 more potentially affected by CVE-2019-0229 via apache-airflow (>=1.8.2, <=1.10.2)

apache-airflow PYPI version =1.8.2, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.4.0rc2, =1.7.2, =0.1.0, =3.0.0, =0.0.12, =0.0.5, =0.0.6 Source cves: CVE-2019-0229 Source advisory: GHSA-W6J4-3GH2-9F5J...

airflow-docker (>=0.1.1, <=0.5.0), airflow-imaging-plugins (>=2.4.2, <=2.4.3) +9 more potentially affected by CVE-2019-0229 via apache-airflow (>=1.8.2, <=1.10.2)

apache-airflow PYPI version =1.8.2, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.4.0rc2, =1.7.2, =0.1.0, =3.0.0, =0.0.12, =0.0.5, =0.0.6 Source cves: CVE-2019-0229 Source advisory: OSV:GHSA-W6J4-3GH2-9F5J...

CVE-2019-0229

A number of HTTP endpoints in the Airflow webserver both RBAC and classic did not have adequate protection and were vulnerable to cross-site request forgery attacks...

airflow-docker (>=0.1.1, <=0.5.0), airflow-imaging-plugins (>=2.4.2, <=2.4.3) +9 more potentially affected by CVE-2019-0229 via apache-airflow (>=1.8.2, <=1.10.2)

apache-airflow PYPI version =1.8.2, =0.1.1, =2.4.2, =1.0.1, =1.2.1, =0.4.0rc2, =1.7.2, =0.1.0, =3.0.0, =0.0.12, =0.0.5, =0.0.6 Source cves: CVE-2019-0229 Source advisory: OSV:PYSEC-2019-215...

CVE-2019-0229

The CVE-2019-0229 entry concerns cross-site request forgery (CSRF) in the Airflow webserver. The affected surface is multiple HTTP endpoints in both the RBAC and classic Airflow webservers, where protections against CSRF are insufficient. Root cause cited across connected sources is lack of adequ...