{"action":"Upgrade apache-airflow to 2.1.2 or later.","affected":[{"fixed":"2.1.2","introduced":"0"}],"component":"apache-airflow","cve_ids":["CVE-2021-35936"],"ecosystem":"PyPI","epss":0.0545,"exploited":false,"fixed_versions":["2.1.2"],"ghsa_id":"GHSA-m6h2-jx9v-58w6","id":"tcs_01M5KGB54PQKXKYEF3EH2Z4YDW","modified_at":"2023-12-06T01:01:18.503302Z","published_at":"2021-08-16T08:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2021-122","https://lists.apache.org/thread.html/r53d6bd7b0a66f92ddaf1313282f10fec802e71246606dd30c16536df%40%3Cusers.airflow.apache.org%3E","https://github.com/advisories/GHSA-m6h2-jx9v-58w6"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2021-122","url":"https://osv.dev/vulnerability/PYSEC-2021-122"}],"summary":"If remote logging is not used, the worker (in the case of CeleryExecutor) or the scheduler (in the case of LocalExecutor) runs a Flask logging server and is listening on a specific port and also binds"}