| Package | Affected versions | Patched versions |
|---|---|---|
| apache-airflow-providers-google | < 22.0.0 | 22.0.0 |
| apache-airflow-providers-google | < 22.0.0 | 22.0.0 |
Apache Airflow providers-google's ComputeEngineSSHHook disables SSH host-key verification by default, exposing SSH traffic between an Airflow worker and a Compute Engine VM to in-path network attackers who can intercept or modify the session. Users are advised to upgrade to apache-airflow-providers-google 22.0.0 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free