Homepage

apache-airflow-providers-microsoft-azure@12.9.0rc2

Provider package apache-airflow-providers-microsoft-azure for Apache Airflow

  • latest version

    14.1.0

  • latest non vulnerable version

    15.0.0rc1

  • first published

    5 years ago

  • latest version published

    13 days ago

  • licenses detected

  • View apache-airflow-providers-microsoft-azure package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the apache-airflow-providers-microsoft-azure package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Authorization Bypass Through User-Controlled Key

    apache-airflow-providers-microsoft-azure is a Provider package apache-airflow-providers-microsoft-azure for Apache Airflow

    Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the get_conn_value and get_variable paths in AzureKeyVaultBackend. An attacker can retrieve another team’s Azure Key Vault connection or variable secret by supplying an ID that names that team’s namespace, causing the backend to fall through from the team-scoped lookup to the team-agnostic lookup and return the secret in full. This affects deployments using multi-team mode with the Azure Key Vault secrets backend enabled. A caller authenticated for one team can read credentials belonging to a different team, exposing connection data and variables that should remain isolated.

    How to fix Authorization Bypass Through User-Controlled Key?

    Upgrade apache-airflow-providers-microsoft-azure to version 14.1.0rc1 or higher.

    [,14.1.0rc1)
    • M
    Insertion of Sensitive Information into Log File

    apache-airflow-providers-microsoft-azure is a Provider package apache-airflow-providers-microsoft-azure for Apache Airflow

    Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the proxies and proxy fields in a Connection. An attacker can obtain sensitive proxy credentials if they are embedded in proxy URLs.

    How to fix Insertion of Sensitive Information into Log File?

    Upgrade apache-airflow-providers-microsoft-azure to version 12.10.1rc1 or higher.

    [,12.10.1rc1)
    Go back to all versions of this package