Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs.
Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated with this vulnerability.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2023/11/12/2 | Mailing List Third Party Advisory |
| https://github.com/apache/airflow/pull/34315 | Patch |
| https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 | Mailing List Vendor Advisory |
Configurations
History
12 Jan 2024, 22:04
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.openwall.com/lists/oss-security/2023/11/12/2 - Mailing List, Third Party Advisory | |
| CWE | NVD-CWE-noinfo |
12 Nov 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
18 Oct 2023, 18:46
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache
Apache airflow |
|
| References | (MISC) https://lists.apache.org/thread/xj86cvfkxgd0cyqfmz6mh1bsfc61c6o9 - Mailing List, Vendor Advisory | |
| References | (MISC) https://github.com/apache/airflow/pull/34315 - Patch | |
| CPE | cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
14 Oct 2023, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-10-14 10:15
Updated : 2024-02-28 20:33
NVD link : CVE-2023-42663
Mitre link : CVE-2023-42663
CVE.ORG link : CVE-2023-42663
JSON object : View
Products Affected
apache
- airflow
CWE