CVE-2022-27949

HIGH7.5EPSS 1.6%

Apache Airflow prior to 2.3.1 may include sensitive values in rendered template

發布日:2022/11/14修改日:2025/5/20

也稱為:GHSA-fvw2-2pf7-77vwBIT-airflow-2022-27949PYSEC-2022-42981

描述

A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example when they were depending on past and previous instances of the task failed). This issue affects Apache Airflow prior to 2.3.1.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.3.1
PyPI/apache-airflowfrom 0, < 2.3.1
PyPI/apache-airflowfrom 0, < 2.3.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-27949
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/09be0c5c7e847dda1d0be5776f8d5e327ff2281a
WEBhttps://github.com/apache/airflow/commit/1cbb0ad26dd17f218c6ab1c2ae59b262c443a443
WEBhttps://github.com/apache/airflow/pull/22754
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42981.yaml
WEBhttps://lists.apache.org/thread/n38oc5obb48600fsvnbopxcs0jpbp65p
WEBhttp://www.openwall.com/lists/oss-security/2022/11/14/3