PyPI/apache-airflow CVE-2021-28359: unknown, EPSS 14.39%
The "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions <1.10.15 in 1.x series and affects 2.0.0 and 2.0.1 and
Action: Upgrade apache-airflow to 1.10.15 or later.
pip install apache-airflow==1.10.15pip install apache-airflow==2.0.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.8.1 | 1.10.15 | - |
| 2.0.0 | 2.0.2 | - |
Fixed versions
| 1.10.15 | 2.0.2 |
Sources
- osv: PYSEC-2021-4
- https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E
- https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432@%3Cannounce.apache.org%3E
- https://github.com/advisories/GHSA-3xxv-p78r-4fc6
CVE-2021-28359 · published · modified · JSON