aind-airflow-jobs (>=0.2.1 <=0.2.6), airflow-ansible-provider (=0.6.0) +15 more potentially affected by CVE-2024-31869 via apache-airflow (>=2.7.1 <=2.8.4)

apache-airflow PYPI version =2.7.1, =0.2.1, =1.1.0, =0.3.1, =0.0.4, =0.0.1a0, =1.0.0rc1, =1.0.0rc1, =1.0.0, =0.1.30, =0.0.1, =0.1.0, =1.1.0.post0.dev45, =1.1.3.post0.dev5 and more Source cves: CVE-2024-31869 Source advisory: OSV:GHSA-2522-MRJC-M688...

CVE-2024-31869 Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.exposeconfig" configuration The celery provider is the only community provider...

CVE-2024-31869

The CVE affects Apache Airflow 2.7.0–2.8.4, where an authenticated user can view sensitive provider configuration on the configuration UI if webserver.expose_config is set to non-sensitive-only; the Celery provider is noted as having sensitive configurations. Impact is information disclosure via ...