Received-SPF: pass (google.com: domain of oss-security-return-30047-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Content-Type: text/plain; charset=utf-8
From: Ephraim Anierobi <ephraimanierobi@apache.org>
To: oss-security@lists.openwall.com
Message-ID: <747a6b7c-6cd3-a027-d0db-7235caa2ea11@apache.org>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 17 Apr 2024 22:19:39 +0000
MIME-Version: 1.0
Subject: [oss-security] =?UTF-8?Q?CVE-2024-31869=3A_Apache_Airflow=3A_Sens?=
 =?UTF-8?Q?itive_configuration_for_providers_displa?=
 =?UTF-8?Q?yed_when_=22non-sensitive-only=22_config?= =?UTF-8?Q?_used=20?=

Severity: low

Affected versions:

- Apache Airflow 2.7.0 through 2.8.4

Description:

Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an =
authenticated user to see sensitive provider configuration via the =
"configuration" UI page=C2=A0when "non-sensitive-only" was set as =
"webserver.expose_config" configuration (The celery provider is the only =
community provider currently that has sensitive configurations). You should=
 migrate to Airflow 2.9 or change your "expose_config" configuration to =
False as a workaround. This is similar, but different to  CVE-2023-46288 =
https://github.com/advisories/GHSA-9qqg-mh7c-chfq  which concerned API, not=
 UI configuration page.

Credit:

Manmeet Rangoola (finder)
Jarek Potiuk (remediation developer)

References:

https://github.com/apache/airflow/pull/38795
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=3DCVE-2024-31869