{"action":"Upgrade apache-airflow to 1.10.13 or later.","affected":[{"fixed":"1.10.13","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2020-17511"],"ecosystem":"PyPI","epss":0.02618,"exploited":false,"fixed_versions":["1.10.13"],"ghsa_id":"GHSA-cvcq-gmc3-q6m8","id":"tcs_01M5KGA3YJZQ6P015EMTGHAA59","modified_at":"2023-12-06T01:00:19.182025Z","published_at":"2020-12-14T10:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-262","https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E","https://github.com/advisories/GHSA-cvcq-gmc3-q6m8"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-262","url":"https://osv.dev/vulnerability/PYSEC-2020-262"}],"summary":"In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection wi"}