PyPI/apache-airflow CVE-2021-45229: unknown, EPSS 2.60%

It was discovered that the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. This issue affects Apache Airflow versions 2.2.3 and below.

Action: Upgrade apache-airflow to 2.2.4rc1 or later.

pip install apache-airflow==2.2.4rc1

Affected

Fixed versions

Sources

• osv: PYSEC-2022-29
• https://lists.apache.org/thread/phx76cgtmhwwdy780rvwhobx8qoy4bnk
• https://github.com/advisories/GHSA-65xw-pcqw-hjrh

CVE-2021-45229 · published 2022-02-25T09:15:00Z · modified 2023-12-06T01:01:43.148675Z · JSON