CVE-2022-40604: Format String Vulnerability

Q: What is CVE-2022-40604?

CVE-2022-40604 is a vulnerability in Apache Airflow 2.3.0 through 2.3.4 that allows for possible information extraction via a formatted URL.

Q: What is the severity of CVE-2022-40604?

The severity of CVE-2022-40604 is high, with a CVSS severity score of 7.5.

Q: How can I fix CVE-2022-40604?

To fix CVE-2022-40604, upgrade to version 2.4.0b1 or higher of Apache Airflow.

Q: Where can I find more information about CVE-2022-40604?

You can find more information about CVE-2022-40604 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-40604), [GitHub Pull Request](https://github.com/apache/airflow/pull/26337), [PYSEC Advisory](https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-279.yaml).

Q: What is CWE-134?

CWE-134 is a vulnerability category related to uncontrolled format string, which is relevant to CVE-2022-40604.

Published Sep 21, 2022

Updated

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

Affected Software

2 affected componentsFixes available

Apache Airflow>=2.3.0<=2.3.4

pip/apache-airflow>=2.3.0<2.4.0rc1

2.4.0rc1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/apache-airflow to a version that resolves this vulnerability.
Fixed in 2.4.0rc1

Event History

Sep 21, 2022

CVE Published

via MITRE·07:25 AM

Data Sourced

via MITRE·07:25 AM

DescriptionWeakness

Data Sourced

via NVD·08:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Sep 22, 2022

Advisory Published

via GitHub·10:40 PM

Frequently Asked Questions

What is CVE-2022-40604?

CVE-2022-40604 is a vulnerability in Apache Airflow 2.3.0 through 2.3.4 that allows for possible information extraction via a formatted URL.

What is the severity of CVE-2022-40604?