CVE-2023-45348: Apache Airflow: Configuration information leakage vulnerability
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the "exposeconfig" option is set to "non-sensitive-only". The exposeconfig option is False by default. It is recommended to upgrade to a version that is not affected.
Other sources
Apache Airflow, versions 2.7.0 and 2.7.1, is affected by a vulnerability that allows an authenticated user to retrieve sensitive configuration information when the exposeconfig option is set to non-sensitive-only. The exposeconfig option is False by default. It is recommended to upgrade to a version that is not affected.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-45348?
CVE-2023-45348 is a vulnerability in Apache Airflow that allows an authenticated user to retrieve sensitive configuration information.
What versions of Apache Airflow are affected by CVE-2023-45348?
Versions 2.7.0 and 2.7.1 of Apache Airflow are affected by CVE-2023-45348.
How can an authenticated user exploit CVE-2023-45348?
An authenticated user can exploit CVE-2023-45348 by setting the `expose_config` option to `non-sensitive-only` and retrieving sensitive configuration information.
What is the default value of the `expose_config` option in Apache Airflow?
The `expose_config` option is `False` by default in Apache Airflow.
How can I fix CVE-2023-45348 in Apache Airflow?
To fix CVE-2023-45348, it is recommended to upgrade Apache Airflow to version 2.7.2.