PT-2023-20252 · Apache · Apache Airflow

Kuteminh11 · Published 2023-03-15 · Updated 2025-02-13 · CVE-2023-25695

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.5.2

Description The issue is related to the generation of error messages containing sensitive information. This could potentially provide useful information to attackers, including the Python/Airflow version and node name, which should not be visible to unauthenticated users.

Recommendations For versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider restricting access to error messages for unauthenticated users to minimize the risk of exploitation.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BIT-AIRFLOW-2023-25695

CVE-2023-25695

GHSA-H6G5-WQQR-3MW3

PYSEC-2023-2

Affected Products

Apache Airflow

References · 14

• https://github.com/apache/airflow/pull/29501 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25695 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-2 · Vendor Advisory
• https://lists.apache.org/thread/z8w6ckzs61ql365tv4d19k82o67r15p2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-25695 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25695 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6g5-wqqr-3mw3 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/965e76d9ed00ef354a834739ac46f24068630951 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-2.yaml · Note
• https://t.me/cvenotify/46195 · Telegram Post
• https://t.me/cvenotify/111202 · Telegram Post
• https://t.me/cvenotify/46196 · Telegram Post
• https://github.com/advisories/GHSA-h6g5-wqqr-3mw3 · Note