PyPI/apache-airflow CVE-2023-35005: medium 6.5, EPSS 1.53%

Apache Airflow vulnerable to exposure of sensitive information

Action: Upgrade apache-airflow to 2.6.2rc1 or later.

pip install apache-airflow==2.6.2rc1

Affected

Fixed versions

Sources

• osv: GHSA-mjff-wv85-hmcj
• https://nvd.nist.gov/vuln/detail/CVE-2023-35005
• https://github.com/apache/airflow/pull/31788
• https://github.com/apache/airflow/pull/31820
• https://github.com/apache/airflow/commit/5679a01919ac9d5153e858f8b1390cbc7915f148
• https://github.com/apache/airflow/commit/f6cda8fb63250fc4700658999739c1c3c5f6625c
• https://github.com/apache/airflow
• https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-89.yaml
• https://lists.apache.org/thread/o4f2cxh0054m9tlxpb81c1yhylor5gjd

CVE-2023-35005 · published 2023-06-19T09:30:17Z · modified 2024-11-22T05:25:55.376204Z · JSON