Uninitialized Memory Exposure Affecting apache-airflow package, versions [,2.10.3)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-APACHEAIRFLOW-8366329
- published 10 Nov 2024
- disclosed 8 Nov 2024
- credit Saurabh Banawar
Introduced: 8 Nov 2024
New CVE-2024-50378 Open this link in a new tabHow to fix?
Upgrade apache-airflow to version 2.10.3 or higher.
Overview
apache-airflow is a platform to programmatically author, schedule, and monitor workflows.
Affected versions of this package are vulnerable to Uninitialized Memory Exposure which allows authenticated users with audit log access to see sensitive unencrypted stored values set via the airflow CLI.
Note: Users who are using the CLI to set secret variables are advised to manually delete entries with those variables from the log table.