Описание
JWT Tokens used by tasks were exposed in logs. This could allow UI users to act as Dag Authors. Users are advised to upgrade to Airflow version that contains fix.
Users are recommended to upgrade to version 3.2.0, which fixes this issue.
Ссылки
- Issue Tracking
- Issue Tracking
- Issue TrackingPatchThird Party Advisory
- Mailing ListVendor Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия от 3.0.0 (включая) до 3.2.0 (исключая)
cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*
EPSS
Процентиль: 52%
0.00739
Низкий
7.5 High
CVSS3
Дефекты
CWE-532
Связанные уязвимости
CVSS3: 7.5
debian
4 месяца назад
JWT Tokens used by tasks were exposed in logs. This could allow UI use ...
EPSS
Процентиль: 52%
0.00739
Низкий
7.5 High
CVSS3
Дефекты
CWE-532