p PatchFirst

CVE-2023-45348

CVE-2023-45348 · Apache Airflow: Configuration information leakage vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "expose_config" option is set to "non-sensitive-only". The `expose_config` option is False by default. It is recommended to upgrade to a version that is not affected.

CVSS 4.3 · Medium · EPSS 1.6% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • apache airflow

    Versions
    • ≥ 2.7.0, < 2.7.2: Affected (semver)

    Update to 2.7.2

  • apache-airflow PyPI

    Versions
    • 2.7.0
    • 2.7.1
    • 2.7.1rc1
    • 2.7.1rc2
    • 2.7.2rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.7.0, < 2.7.2

    Update to 2.7.2

Original sources

Check your server →