PT-2019-8250 · Apache · Apache Airflow

Publicado 2019-01-23 · Atualizado 2019-04-19 · CVE-2017-17836

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 1.8.2 and earlier

Description The issue allows an attacker with limited access to Airflow to exfiltrate all credentials from the system. This can occur through various means, such as XSS or by gaining physical access to an unlocked machine. The experimental Airflow feature in question displays authenticated cookies and passwords to databases used by Airflow, thus facilitating the exfiltration of sensitive information.

Recommendations For Apache Airflow versions 1.8.2 and earlier, consider disabling the experimental feature that displays authenticated cookies and database passwords as a temporary workaround until a patch is available. Restrict access to the Airflow system to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

CWE-255

Identificadores relacionados

CVE-2017-17836

GHSA-9GQG-3FXR-9HV7

PYSEC-2019-149

Produtos afetados

Apache Airflow

Referências · 9

• https://github.com/apache/airflow · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-149.yaml · Nota
• https://osv.dev/vulnerability/CVE-2017-17836 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-17836 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2019-149 · Aviso do Fabricante
• https://github.com/advisories/GHSA-9gqg-3fxr-9hv7 · Nota
• https://osv.dev/vulnerability/GHSA-9gqg-3fxr-9hv7 · Aviso do Fabricante
• https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57%40%3Cdev.airflow.apache.org%3E · Nota
• https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E · Nota