CVE-2022-46651: Infoleak
First published: Wed Jul 12 2023(Updated: )
Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows an unauthorized actor to gain access to sensitive information in Connection edit view. This vulnerability is considered low since it requires someone with access to Connection resources specifically updating the connection to exploit it. Users should upgrade to version 2.6.3 or later which has removed the vulnerability.
Credit: security@apache.org security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/apache-airflow | <2.6.3 | 2.6.3 |
| Apache Airflow | <2.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/32309
- https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d
- https://nvd.nist.gov/vuln/detail/CVE-2022-46651
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2023-103.yaml
- https://github.com/apache/airflow/commit/d01248382fe45a5f5a7fdeed4082a80c5f814ad8
- https://github.com/advisories/GHSA-xvw9-3mhm-xjqq (Advisory)
Frequently Asked Questions
What is CVE-2022-46651?
CVE-2022-46651 is a vulnerability in Apache Airflow versions before 2.6.3 that allows an unauthorized actor to gain access to sensitive information in the Connection edit view.
What is the severity of CVE-2022-46651?
CVE-2022-46651 has a severity rating of 6.5 (medium).
How does CVE-2022-46651 affect Apache Airflow?
CVE-2022-46651 affects Apache Airflow versions before 2.6.3 by exposing sensitive information in the Connection edit view.
How can I fix CVE-2022-46651?
To fix CVE-2022-46651, update your Apache Airflow installation to version 2.6.3 or higher.
Where can I find more information about CVE-2022-46651?
You can find more information about CVE-2022-46651 on the following references: [GitHub](https://github.com/apache/airflow/pull/32309), [Apache Mailing List](https://lists.apache.org/thread/n45h3y82og125rnlgt6rbm9szfb6q24d), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-46651).
- collector/nvd-latest
- collector/nvd-index
- collector/nvd-cve
- collector/github-advisory-latest
- alias/GHSA-xvw9-3mhm-xjqq
- alias/CVE-2022-46651
- collector/github-advisory
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/last-modified-date
- agent/remedy
- agent/first-publish-date
- agent/severity
- agent/weakness
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- vendor/apache
- canonical/apache airflow
- package-manager/pip