PyPI/apache-airflow CVE-2020-17513: medium 5.3, EPSS 4.38%

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

Action: Upgrade apache-airflow to 1.10.13 or later.

pip install apache-airflow==1.10.13

Affected

Fixed versions

Sources

• osv: PYSEC-2020-20
• nvd: CVE-2020-17513
• https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E
• https://github.com/advisories/GHSA-6r3p-fcvm-xh7c

CVE-2020-17513 · published 2020-12-14T10:15:00Z · modified 2023-12-06T01:00:19.243518Z · JSON