p PatchFirst

CVE-2017-12614

CVE-2017-12614

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't, and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.

CVSS 6.1 · Medium · EPSS 2.0% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • < 1.9.0: Affected

    No fix published

  • apache-airflow PyPI

    Versions
    • 1.8.1
    • 1.8.2
    • 1.8.2rc1
    Affected ranges
    • ECOSYSTEM: < 1.9.0

    Update to 1.9.0

Original sources

Check your server →