Apache Airflow vulnerable to exposure of sensitive information

中 6.5CVE-2023-35005 · BIT-airflow-2023-35005 · GHSA-mjff-wv85-hmcj · 19/06/2023 公開 · 17/06/2026 更新

要点

CVE-2023-35005 は apache-airflow, airflow (apache) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.5%（全脆弱性の 74.8% より高い）。
対処：2.6.2, 2.6.2rc1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow PyPI	`≥ 2.5.0, < 2.6.2≥ 2.5.0, < 2.6.2rc1`	`2.6.22.6.2rc1`
airflow apache	`≥ 2.5.0, < 2.6.2`	`2.6.2`

概要

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations.

This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if [webserver] expose_config is set to non-sensitive-only), and not all uncensored values are actually sentitive.

This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.

NVD の説明

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default (only if `[webserver] expose_config` is set to `non-sensitive-only`), and not all uncensored values are actually sentitive. This issue affects Apache Airflow: from 2.5.0 before 2.6.2. Users are recommended to update to version 2.6.2 or later.