PyPI/apache-airflow CVE-2022-40604: unknown, EPSS 2.08%

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

Action: Upgrade apache-airflow to 2.4.0b1 or later.

pip install apache-airflow==2.4.0b1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-279
• https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t
• https://github.com/apache/airflow/pull/26337
• https://github.com/advisories/GHSA-5rp4-749p-vx26

CVE-2022-40604 · published 2022-09-21T08:15:00Z · modified 2026-06-10T17:00:08.828936483Z · JSON