CVE-2024-31869: Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used
First published: Wed Apr 17 2024(Updated: )
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 https://github.com/advisories/GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.
Credit: security@apache.org security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/apache-airflow | >=2.7.0<2.9.0 | 2.9.0 |
| Apache Airflow | >=2.7.0<2.9.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/apache/airflow/pull/38795
- https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3
- https://nvd.nist.gov/vuln/detail/CVE-2024-31869
- https://github.com/apache/airflow/commit/042c2acaed7c01933d37c2f8434640ce140a4b27
- https://github.com/advisories/GHSA-2522-mrjc-m688 (Advisory)
- http://www.openwall.com/lists/oss-security/2024/04/17/10
Frequently Asked Questions
What is the severity of CVE-2024-31869?
CVE-2024-31869 has been classified as a medium severity vulnerability.
How do I fix CVE-2024-31869?
To fix CVE-2024-31869, upgrade your Apache Airflow version to 2.9.0 or later.
What does CVE-2024-31869 exploit?
CVE-2024-31869 allows an authenticated user to access sensitive provider configuration information through the configuration UI when exposed improperly.
Which versions of Apache Airflow are affected by CVE-2024-31869?
Apache Airflow versions 2.7.0 through 2.8.4 are affected by CVE-2024-31869.
Who is impacted by CVE-2024-31869?
Authenticated users of Apache Airflow who have access to the configuration UI may be impacted by CVE-2024-31869.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2024-31869
- agent/title
- agent/first-publish-date
- agent/weakness
- agent/type
- agent/description
- agent/author
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/references
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- source/GitHub
- alias/GHSA-2522-mrjc-m688
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/trending
- agent/source
- collector/github-advisory-latest
- agent/last-modified-date
- collector/nvd-api
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/event
- agent/tags
- package-manager/pip
- vendor/apache
- canonical/apache airflow
- version/apache airflow/2.7.0