Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

CAO 7.5CVE-2023-46215 · BIT-airflow-2023-46215 · GHSA-666g-rfc5-c9jv · Công bố 28/10/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-46215 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng apache-airflow, apache-airflow-providers-celery, airflow (apache).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.6%, cao hơn 75.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.7.0, 3.4.1 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
apache-airflow PyPI	`≥ 1.10.0, < 2.7.0`	`2.7.0`
apache-airflow-providers-celery PyPI	`≥ 3.3.0, < 3.4.1`	`3.4.1`
airflow apache	`≥ 1.10.0, < 2.7.0`	`2.7.0`
airflow celery provider apache	`≥ 3.3.0, ≤ 3.4.0`	Chưa có bản vá

Mô tả

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.

Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs.

This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.

Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Mô tả của NVD

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.