CVE-2025-57735
Apache Airflow: Airflow Logout Not Invalidating JWT
9.1
CRITICAL
CVSS 3.1
EPSS 0.67%
描述
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanism that implements token invalidation at logout. Users who are concerned about the logout scenario and possibility of intercepting the tokens, should upgrade to Airflow 3.2+ Users are recommended to upgrade to version 3.2.0, which fixes this issue.
如何修補 CVE-2025-57735
要修補 CVE-2025-57735,請將受影響套件升級到下列已修補版本。
- —升級至 3.2.0 或更新版本
CVE-2025-57735 正在被利用嗎?
低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。
受影響套件(1)
- >= 3.0.0, < 3.2.0
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | CRITICAL9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |