CVE-2017-17836
2 advisories.
PyPI/apache-airflow CVE-2017-17836: critical 9.8
Apache Airflow vulnerable to XSS
Action: Upgrade apache-airflow to 1.9.0 or later.
pip install apache-airflow==1.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.9.0 | - |
Fixed versions
| 1.9.0 |
Sources
- osv: GHSA-9gqg-3fxr-9hv7
- https://nvd.nist.gov/vuln/detail/CVE-2017-17836
- https://github.com/advisories/GHSA-9gqg-3fxr-9hv7
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-149.yaml
- https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
CVE-2017-17836 · published · modified · JSON
PyPI/apache-airflow CVE-2017-17836: unknown
In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow,
Action: Upgrade apache-airflow to 1.9.0 or later.
pip install apache-airflow==1.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.9.0 | - |
Fixed versions
| 1.9.0 |
Sources
- osv: PYSEC-2019-149
- https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
- https://github.com/advisories/GHSA-9gqg-3fxr-9hv7
CVE-2017-17836 · published · modified · JSON