PT-2023-8626 · Apache · Apache Airflow

Hussein Awala + 1 · Published 2023-10-14 · Updated 2024-05-01 · CVE-2023-45348

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.7.0 through 2.7.1

Description The issue allows an authenticated user to retrieve sensitive configuration information when the expose config option is set to "non-sensitive-only". The expose config option is False by default. Approximately 39,118 devices may be affected.

Recommendations For Apache Airflow versions 2.7.0 and 2.7.1, it is recommended to upgrade to a version that is not affected. As a temporary workaround, consider setting the expose config option to False to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2024-01279

BIT-AIRFLOW-2023-45348

CVE-2023-45348

GHSA-FPXX-XV4C-GXQP

PYSEC-2023-204

Affected Products

Apache Airflow

References · 18

• https://github.com/apache/airflow/pull/34712 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-45348 · Security Note
• https://lists.apache.org/thread/sy4l5d6tn58hr8r61r2fkt1f0qock9z9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01279 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45348 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2023-45348 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fpxx-xv4c-gxqp · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-204 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/a4a0b5dd3d0ce05311c70bb9a32b66a650dbc0b4 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-204.yaml · Note
• https://twitter.com/NUYTSTECH/status/1714557442322034962 · Twitter Post
• http://openwall.com/lists/oss-security/2023/10/23/2 · Note
• https://twitter.com/zoomeye_team/status/1714108888537321833 · Twitter Post
• https://t.me/cvenotify/78741 · Telegram Post