p PatchFirst

CVE-2022-40604

CVE-2022-40604 · Format String Vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

CVSS 7.5 · High · EPSS 2.1% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • ≥ unspecified, < 2.4.0: Affected (custom)
    • ≥ 2.3.0, < unspecified: Affected (custom)

    Update to 2.4.0

  • apache-airflow PyPI

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.1rc1
    • 2.3.2
    • 2.3.2rc1
    • 2.3.2rc2
    • 2.3.3
    • 2.3.3rc1
    • 2.3.3rc2
    • 2.3.3rc3
    • 2.3.4
    • 2.3.4rc1
    • 2.4.0b1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.4.0rc1

    Update to 2.4.0rc1

  • apache-airflow PyPI

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.1rc1
    • 2.3.2
    • 2.3.2rc1
    • 2.3.2rc2
    • 2.3.3
    • 2.3.3rc1
    • 2.3.3rc2
    • 2.3.3rc3
    • 2.3.4
    • 2.3.4rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.4.0b1

    Update to 2.4.0b1

Original sources

Check your server →