{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.2.0"}],"component":"apache-airflow","cve_ids":["CVE-2024-42447"],"ecosystem":"PyPI","epss":0.00929,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-62qf-qm3g-fvcw","id":"tcs_01M5KGMTEPZ4Q4A2JW9355234M","modified_at":"2026-07-07T17:57:04.555210725Z","published_at":"2024-08-05T08:15:56.397Z","references":["https://osv.dev/vulnerability/PYSEC-2024-265","http://www.openwall.com/lists/oss-security/2024/08/04/2","https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52","https://github.com/apache/airflow/pull/40784"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2024-265","url":"https://osv.dev/vulnerability/PYSEC-2024-265"}],"summary":"Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB."}