Homepage

apache-airflow@3.2.0rc2

Programmatically author, schedule and monitor data pipelines

  • latest version

    3.3.0

  • latest non vulnerable version

    3.3.0

  • first published

    9 years ago

  • latest version published

    4 days ago

  • licenses detected

  • View apache-airflow package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the apache-airflow package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Multiple Operations on Resource in Single-Operation Context

    apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

    Affected versions of this package are vulnerable to Multiple Operations on Resource in Single-Operation Context due to improper redaction in the Variable response masker when handling deeply nested JSON values. An attacker can access plaintext sensitive data by reading variable values with secret-suffixed key names nested beyond the masker's recursion limit. This is only exploitable if sensitive information is stored within deeply nested JSON variables and the attacker has authenticated UI or API access with variable read permissions.

    How to fix Multiple Operations on Resource in Single-Operation Context?

    Upgrade apache-airflow to version 3.2.2rc1 or higher.

    [,3.2.2rc1)
    • M
    Improper Removal of Sensitive Information Before Storage or Transfer

    apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

    Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer in the Config API when per-key secrets backend overrides are configured via environment variables. An attacker can obtain plaintext secrets-backend credentials by accessing the API output, as sensitive information is not properly redacted. This is only exploitable if secrets backends are configured using per-key environment variable overrides.

    How to fix Improper Removal of Sensitive Information Before Storage or Transfer?

    Upgrade apache-airflow to version 3.3.0b1 or higher.

    [,3.3.0b1)
    • H
    Cleartext Transmission of Sensitive Information

    apache-airflow is a platform to programmatically author, schedule, and monitor workflows.

    Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the FTPSHook.get_conn process not invoking prot_p, resulting in the data channel being transmitted in cleartext. An attacker can intercept sensitive file contents and credentials by monitoring the network traffic between the client and server.

    How to fix Cleartext Transmission of Sensitive Information?

    Upgrade apache-airflow to version 3.3.0b1 or higher.

    [,3.3.0b1)
    Go back to all versions of this package