PT-2023-20252 · Apache · Apache Airflow

Kuteminh11 · Publicado 2023-03-15 · Atualizado 2025-02-13 · CVE-2023-25695

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.5.2

Description The issue is related to the generation of error messages containing sensitive information. This could potentially provide useful information to attackers, including the Python/Airflow version and node name, which should not be visible to unauthenticated users.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to error messages for unauthenticated users to minimize the risk of exploitation.

Correção

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-209

Identificadores relacionados

BIT-AIRFLOW-2023-25695

CVE-2023-25695

GHSA-H6G5-WQQR-3MW3

PYSEC-2023-2

Produtos afetados

Apache Airflow

Referências · 14

• https://github.com/apache/airflow · Nota
• https://github.com/apache/airflow/pull/29501 · Correção
• https://github.com/apache/airflow/commit/965e76d9ed00ef354a834739ac46f24068630951 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-2.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-25695 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2023-2 · Aviso do Fabricante
• https://t.me/cvenotify/46195 · Publicação no Telegram
• https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2 · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-airflow-2023-25695 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-25695 · Aviso do Fabricante
• https://t.me/cvenotify/111202 · Publicação no Telegram
• https://t.me/cvenotify/46196 · Publicação no Telegram
• https://github.com/advisories/GHSA-h6g5-wqqr-3mw3 · Nota
• https://osv.dev/vulnerability/GHSA-h6g5-wqqr-3mw3 · Aviso do Fabricante