PyPI/apache-airflow CVE-2022-41672: high 8.1, EPSS 1.48%

Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

Action: Upgrade apache-airflow to 2.4.1rc1 or later.

pip install apache-airflow==2.4.1rc1

Affected

Fixed versions

Sources

• osv: GHSA-3q8r-f3pj-3gc4
• https://nvd.nist.gov/vuln/detail/CVE-2022-41672
• https://github.com/apache/airflow/pull/26635
• https://github.com/apache/airflow/commit/12bfb571a895a28a58d3189b0fc10cfc1b89e24c
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42983.yaml
• https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y

CVE-2022-41672 · published 2022-10-07T18:16:01Z · modified 2024-09-11T18:41:14.507198Z · JSON