CVE-2022-46651

MEDIUM6.5EPSS 0.17%

Apache Airflow: Security vulnerability on AirFlow Connections

發布日:2023/7/12修改日:2025/5/20

也稱為:GHSA-xvw9-3mhm-xjqqBIT-airflow-2022-46651PYSEC-2023-103

描述

Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.

受影響套件(3)

Bitnami/airflowfrom 0, < 2.6.3
PyPI/apache-airflowfrom 0, < 2.6.3
PyPI/apache-airflowfrom 0, < 2.6.3

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

參考連結(6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2022-46651
PATCHhttps://github.com/apache/airflow
WEBhttps://github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8
WEBhttps://github.com/apache/airflow/pull/32309
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml
WEBhttps://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d