PT-2024-9206 · Apache · Apache Airflow

Amogh Desai + 1 · Published 2024-11-15 · Updated 2024-11-25 · CVE-2024-45784

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions before 2.10.3

Description: The issue is related to the exposure of sensitive configuration variables in task logs. This could allow unauthorized users to access critical data, potentially compromising the security of the Airflow deployment. The estimated number of potentially affected devices worldwide is over 54,000, as indicated by a search on ZoomEye.

Recommendations: To resolve the issue, users should upgrade to Airflow 2.10.3 or the latest version. If you suspect that DAG authors could have logged the secret values to the logs and that your logs are not additionally protected, it is also recommended that you update those secrets.

Fix

Weakness Enumeration

CWE-1295

Related Identifiers

BDU:2024-10894

BIT-AIRFLOW-2024-45784

CVE-2024-45784

GHSA-46C3-5XC5-WWHV

PYSEC-2024-182

Affected Products

Apache Airflow

References · 27

• https://github.com/apache/airflow/pull/43040 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-45784 · Security Note
• https://osv.dev/vulnerability/CVE-2024-45784 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10894 · Security Note
• https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-46c3-5xc5-wwhv · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2024-182 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-airflow-2024-45784 · Vendor Advisory
• https://github.com/apache/airflow · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-182.yaml · Note
• https://t.me/cvenotify/101795 · Telegram Post
• https://twitter.com/oss_security/status/1857318773721530563 · Twitter Post
• https://twitter.com/fridaysecurity/status/1857975452326846470 · Twitter Post
• https://twitter.com/fletch_ai/status/1858782401666883743 · Twitter Post
• https://twitter.com/CCBalert/status/1858610391254761900 · Twitter Post