PT-2024-4257 · Apache · Apache Airflow

Jens Scheffler · CVE-2024-25142 · Published 2024-06-13 · Updated 2024-12-11

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.9.2

Description The issue is related to the use of web browser cache containing sensitive information in Apache Airflow. Airflow did not return a "Cache-Control" header for dynamic content, which could result in potentially storing sensitive data in the local cache of the browser. This could allow an attacker to disclose protected information through the Cache-Control header.

Recommendations For Apache Airflow versions prior to 2.9.2, upgrade to version 2.9.2, which fixes the issue. As a temporary workaround, consider configuring the browser to disable caching of sensitive data or restricting access to sensitive information until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-525

Related Identifiers

BDU:2024-04744

BIT-AIRFLOW-2024-25142

CVE-2024-25142

GHSA-9XPJ-62MM-24H2

PYSEC-2024-195

Affected Products

Apache Airflow

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25142.json · Exploit
• https://github.com/apache/airflow/pull/39550 · Patch
• https://osv.dev/vulnerability/GHSA-9xpj-62mm-24h2 · Vendor Advisory
• https://lists.apache.org/thread/cg1j28lk0fhzthk0of1g7vy7p2n1j7nr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25142 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04744 · Security Note
• https://osv.dev/vulnerability/BIT-airflow-2024-25142 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25142 · Security Note
• https://github.com/apache/airflow · Note
• https://github.com/apache/airflow/commit/94eb647de692a4d9555b02dce85974da5d4c04e3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-195.yaml · Note
• https://twitter.com/CVEnew/status/1801547307374027148 · Twitter Post
• https://vuldb.com/?id.268426 · Note
• https://github.com/advisories/GHSA-9xpj-62mm-24h2 · Note