apache-airflow@2.5.2rc2 vulnerabilities

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Certificate Validation for FTP_TLS connections, which are created without setting the proper context using ssl.create_default_context().

Upgrade apache-airflow to version 2.9.0b1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Default Permissions that allow Ops and Viewers users to view all information in audit logs, including DAG names and usernames they are not permitted to view.

Upgrade apache-airflow to version 2.8.2rc1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to improper permission checks in the API and UI components. An attacker can view DAG code and import errors for DAGs they are not authorized to access by exploiting this vulnerability.

Upgrade apache-airflow to version 2.8.2 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Authorization due to improper validation of the dag_id, allowing unauthorized read access to a DAG through the URL.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper validation of input during the deserialization process of XCom data. An attacker can execute arbitrary code by submitting crafted input that bypasses the protection of the enable_xcom_pickling=False configuration setting, leading to poisoned data after deserialization.

Upgrade apache-airflow to version 2.8.1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Missing Authorization via the permission verification process. An attacker can read the source code of a DAG without having the proper permissions by exploiting this vulnerability.

Upgrade apache-airflow to version 2.8.1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the deferrable mode with the path of a Kubernetes configuration file for authentication. An attacker can obtain the configuration file and use it to access the Kubernetes cluster by accessing the metadata or triggerer log, where the configuration dictionary is stored as plain text without masking.

Upgrade apache-airflow to version 2.6.1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Denial of Service (DoS) allowing an attacker to cause a service disruption by manipulating the run_id parameter.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Access Control allowing an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources that the user had no access to.

NOTE: This was thought to be fixed in version 2.7.2, with the publication of CVE-2023-42792, but it was missed.

Upgrade apache-airflow to version 2.8.0b1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Access Control via the varimport endpoint. A user who lacks the variable edit permission can edit a variable.

Upgrade apache-airflow to version 2.8.0b1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Authorization in forms.py that allows authenticated users with DAG-view permission to modify some DAG run detail values (such as configuration parameters, start date, etc.) when submitting notes.

This vulnerability is the same one described by CVE-2023-40611, which has now been fixed.

Upgrade apache-airflow to version 2.7.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Access Control in handling task instances. A user can read information about task instances in other DAGs.

Upgrade apache-airflow to version 2.7.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure through the REST API for configuration. An attacker can gain access to sensitive configuration information by reading the configuration, even when the expose_config option is set to non-sensitive-only.

Upgrade apache-airflow to version 2.7.0b1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Access Control allowing authenticated users to list warnings for all DAGs, even if the user had no permission reveal the dag_ids and the stack-traces of import errors for those DAGs with import errors.

Upgrade apache-airflow to version 2.7.2 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Access Control allowing an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources that the user had no access to.

NOTE: This was thought to be fixed in version 2.7.2, but was missed and later addressed with the publication of CVE-2023-48291.

Upgrade apache-airflow to version 2.7.2 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure due to the improper access control mechanism, an authorized user with read access to specific Directed Acyclic Graphs (DAGs) can access information about task instances in other DAGs.

Note: This is only exploitable if the user has been granted read access to specific DAGs.

Upgrade apache-airflow to version 2.7.2 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Insecure Defaults when it had support for the deserialize flag by default in the 'xcomEntries' API. This was an unsafe default, as deserialization may instantiate arbitrary objects.

Upgrade apache-airflow to version 2.7.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Authorization in forms.py that allows authenticated users with DAG-view permission to modify some DAG run detail values (such as configuration parameters, start date, etc.) when submitting notes.

NOTE: This vulnerability was originally marked as fixed in 2.7.1 but the fix did not make it into that version. It was subsequently fixed in 2.7.3 and also assigned CVE-2023-47037.

Upgrade apache-airflow to version 2.7.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure in a rendered template generated with views.py and timezone.py. Users who have access to see the task/dag in the UI can craft a URL, which could unmask the masked configuration of the task.

Upgrade apache-airflow to version 2.7.1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Denial of Service (DoS) that can be exploited by an authenticated user with Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests, leading to a denial of service (DoS) condition on the server.

Note:

Malicious actors can leverage this vulnerability to establish harmful connections with the server.

Mitigation:

Administrators are encouraged to review and adjust user permissions to restrict access to sensitive functionalities, reducing the attack surface.

Upgrade apache-airflow to version 2.7.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Certificate Validation. Due to the improper validation in the SSL context, an attacker could potentially intercept the client's communication in a MITM position. This vulnerability allows for the acceptance of any server's X.509 certificate leading to possible disclosure of mail server credentials or mail content.

Note:

This is only exploitable if the default SSL context is being used. The attacker will need to inject themselves within the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications.

Upgrade apache-airflow to version 2.7.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Session Fixation. An authenticated user can continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user.

Note: Other than manually cleaning the session database (for database session backend), or changing the secure_key and restarting the webserver, there are no mechanisms to force-logout the user.

Upgrade apache-airflow to version 2.7.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Execution with Unnecessary Privileges via the "Run Task" feature, which allows users to execute code in the webserver context and access certain DAGs.

Upgrade apache-airflow to version 2.6.0b1 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Input Validation which allows an authenticated user to use crafted input to make the current request hang.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Authorization due to improper validation of the dag_id parameter, which allows unauthorized read access to a DAG through the URL.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Directory Traversal by manipulating the run_id parameter due to improper input sanitization, which allows an attacker to perform unauthorized file access outside the intended directory structure.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure via the Connection edit view, which allows an unauthorized actor to gain access to sensitive information

Note: Exploiting this vulnerability requires someone with access to Connection resources, specifically updating the connection to exploit it.

Upgrade apache-airflow to version 2.6.3 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure when potentially sensitive values are shown to the user in certain situations.

NOTE: By default, [webserver] expose_config is set to False. This vulnerability is only exploitable if it is set to non-sensitive-only instead.

Upgrade apache-airflow to version 2.6.2 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Privilege Escalation due to missing permissions validation in the File Task Handler. An attacker can use airflow logs to trigger this vulnerability.

Note: Default permissions are set to group-writeable allowing for impersonation use case.

Upgrade apache-airflow to version 2.6.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization via the task instance details page in the UI.

Upgrade apache-airflow to version 2.6.0 or higher.

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure such that the UI traceback contains information that might be useful for a potential attacker to better target their attack.

Upgrade apache-airflow to version 2.5.2 or higher.