Homepage

apache-airflow-providers-microsoft-azure@13.5.1rc1

Provider package apache-airflow-providers-microsoft-azure for Apache Airflow

  • latest version

    14.1.0

  • latest non vulnerable version

    15.0.0rc1

  • first published

    5 years ago

  • latest version published

    12 days ago

  • licenses detected

  • View apache-airflow-providers-microsoft-azure package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the apache-airflow-providers-microsoft-azure package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Authorization Bypass Through User-Controlled Key

    apache-airflow-providers-microsoft-azure is a Provider package apache-airflow-providers-microsoft-azure for Apache Airflow

    Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the get_conn_value and get_variable paths in AzureKeyVaultBackend. An attacker can retrieve another team’s Azure Key Vault connection or variable secret by supplying an ID that names that team’s namespace, causing the backend to fall through from the team-scoped lookup to the team-agnostic lookup and return the secret in full. This affects deployments using multi-team mode with the Azure Key Vault secrets backend enabled. A caller authenticated for one team can read credentials belonging to a different team, exposing connection data and variables that should remain isolated.

    How to fix Authorization Bypass Through User-Controlled Key?

    Upgrade apache-airflow-providers-microsoft-azure to version 14.1.0rc1 or higher.

    [,14.1.0rc1)
    Go back to all versions of this package