Information Exposure Affecting prefect package, versions [,0.12.5)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PREFECT-3166306
- published 9 Dec 2022
- disclosed 9 Dec 2022
- credit Unknown
How to fix?
Upgrade prefect to version 0.12.5 or higher.
Overview
prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.
Affected versions of this package are vulnerable to Information Exposure due to storing the password in Postgres tasks' initialization methods.
References
CVSS Scores
version 3.1