PT-2020-15028 · Apache · Airflow

Ali Al-Habsi · Published 2020-12-14 · Updated 2024-03-06 · CVE-2020-17511

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 1.10.13

Description The issue occurs when creating a user using the airflow CLI or when creating a Connection with a password field in Airflow, where the password gets logged in plain text in the Log table in Airflow Metadata.

Recommendations For versions prior to 1.10.13, update to version 1.10.13 or later to resolve the issue.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

BIT-AIRFLOW-2020-17511

CVE-2020-17511

GHSA-CVCQ-GMC3-Q6M8

PYSEC-2020-262

Affected Products

Airflow

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2020-17511 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2020-17511 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cvcq-gmc3-q6m8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17511 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/4e32546faf227a6497ce8b282fff7450cae6f665 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-262.yaml · Note
• https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E · Note
• https://t.me/cibsecurity/20731 · Telegram Post
• https://github.com/advisories/GHSA-cvcq-gmc3-q6m8 · Note