Apache Airflow vulnerable to sensitive information exposure when expose-config is set to non-sensitive-only

中 4.3CVE-2023-45348 · BIT-airflow-2023-45348 · GHSA-fpxx-xv4c-gxqp · 14/10/2023 公開 · 17/06/2026 更新

要点

CVE-2023-45348 は apache-airflow, airflow (apache) に影響する深刻度「中」 (CVSS 4.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.6%（全脆弱性の 75.8% より高い）。
対処：2.7.2 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
apache-airflow PyPI	`≥ 2.7.0, < 2.7.2`	`2.7.2`
airflow apache	`≥ 2.7.0, < 2.7.2`	`2.7.2`

概要

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected.

NVD の説明

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.