Homepage
About Snyk

apache-airflow@2.8.0rc4 vulnerabilities

Programmatically author, schedule and monitor data pipelines

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the apache-airflow package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Certificate Validation

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Certificate Validation for FTP_TLS connections, which are created without setting the proper context using ssl.create_default_context().

How to fix Improper Certificate Validation?

Upgrade apache-airflow to version 2.9.0b1 or higher.

[,2.9.0b1)
  • M
Information Exposure

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure via the configuration UI page. An attacker can see sensitive provider configuration by setting webserver.expose_config to non-sensitive-only, even though the celery provider is the only community provider currently that has sensitive configurations.

Note:

This is only exploitable if webserver.expose_config configuration is set to non-sensitive-only.

How to fix Information Exposure?

Upgrade apache-airflow to version 2.9.0 or higher.

[2.7.0,2.9.0)
  • M
Incorrect Default Permissions

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Default Permissions that allow Ops and Viewers users to view all information in audit logs, including DAG names and usernames they are not permitted to view.

How to fix Incorrect Default Permissions?

Upgrade apache-airflow to version 2.8.2rc1 or higher.

[,2.8.2rc1)
  • M
Exposure of Resource to Wrong Sphere

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to improper permission checks in the API and UI components. An attacker can view DAG code and import errors for DAGs they are not authorized to access by exploiting this vulnerability.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade apache-airflow to version 2.8.2 or higher.

[,2.8.2)
  • M
Deserialization of Untrusted Data

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper validation of input during the deserialization process of XCom data. An attacker can execute arbitrary code by submitting crafted input that bypasses the protection of the enable_xcom_pickling=False configuration setting, leading to poisoned data after deserialization.

How to fix Deserialization of Untrusted Data?

Upgrade apache-airflow to version 2.8.1 or higher.

[,2.8.1)
  • M
Missing Authorization

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Missing Authorization via the permission verification process. An attacker can read the source code of a DAG without having the proper permissions by exploiting this vulnerability.

How to fix Missing Authorization?

Upgrade apache-airflow to version 2.8.1 or higher.

[,2.8.1)
  • M
Cross-site Request Forgery (CSRF)

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) that allows triggering a DAG in a GET request, by convincing a user who is authenticated to the Airflow UI to visit a malicious website in the same browser.

How to fix Cross-site Request Forgery (CSRF)?

Upgrade apache-airflow to version 2.8.0 or higher.

[2.7.0,2.8.0)
Go back to all versions of this package