{"action":"Upgrade apache-airflow to 1.10.1 or later.","affected":[{"fixed":"1.10.1","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2018-20245"],"ecosystem":"PyPI","epss":0.01016,"exploited":false,"fixed_versions":["1.10.1"],"ghsa_id":"GHSA-77rc-x84q-pv4f","id":"tcs_01M5KG8JH1YB3KD95YB21BH9Q1","modified_at":"2023-11-08T04:00:11.459468Z","published_at":"2019-01-23T17:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2019-143","https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c33054244343927bbfb2a4cdc4cf73@%3Cdev.airflow.apache.org%3E","https://github.com/advisories/GHSA-77rc-x84q-pv4f"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2019-143","url":"https://osv.dev/vulnerability/PYSEC-2019-143"}],"summary":"The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checkin"}