Homepage
About Snyk

apache-airflow@2.8.2rc2 vulnerabilities

Programmatically author, schedule and monitor data pipelines

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the apache-airflow package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
Improper Certificate Validation

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Improper Certificate Validation for FTP_TLS connections, which are created without setting the proper context using ssl.create_default_context().

How to fix Improper Certificate Validation?

Upgrade apache-airflow to version 2.9.0b1 or higher.

[,2.9.0b1)
  • M
Information Exposure

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Information Exposure via the configuration UI page. An attacker can see sensitive provider configuration by setting webserver.expose_config to non-sensitive-only, even though the celery provider is the only community provider currently that has sensitive configurations.

Note:

This is only exploitable if webserver.expose_config configuration is set to non-sensitive-only.

How to fix Information Exposure?

Upgrade apache-airflow to version 2.9.0 or higher.

[2.7.0,2.9.0)
  • M
Incorrect Privilege Assignment

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment that allows a bypass via the UI. A user can access resources such as variables and connections without the necessary permissions.

How to fix Incorrect Privilege Assignment?

Upgrade apache-airflow to version 2.8.3rc1 or higher.

[2.8.0,2.8.3rc1)
  • M
Exposure of Resource to Wrong Sphere

apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to improper permission checks in the API and UI components. An attacker can view DAG code and import errors for DAGs they are not authorized to access by exploiting this vulnerability.

How to fix Exposure of Resource to Wrong Sphere?

Upgrade apache-airflow to version 2.8.2 or higher.

[,2.8.2)
Go back to all versions of this package