PYSEC-2023-268
Quick fix
PYSEC-2023-268 — apache-dolphinscheduler: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-dolphinscheduler>=3.0.2'Details
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.
The information exposed to unauthorized actors may include sensitive data such as database credentials.
Users who can't upgrade to the fixed version can also set environment variable `MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus` to workaround this, or add the following section in the `application.yaml` file
``` management: endpoints: web: exposure: include: health,metrics,prometheus ```
This issue affects Apache DolphinScheduler: from 3.0.0 before 3.0.2.
Users are recommended to upgrade to version 3.0.2, which fixes the issue.
Are you affected?
Enter the version of the package you're using.
Affected packages
3.0.0Fixed in: 3.0.2pip install --upgrade 'apache-dolphinscheduler>=3.0.2'References
- https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo[ARTICLE]
- https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo[WEB]
- https://lists.apache.org/thread/ffrmkcwgr2lcz0f5nnnyswhpn3fytsvo[ADVISORY]
- http://www.openwall.com/lists/oss-security/2023/11/24/1[ARTICLE]
- http://www.openwall.com/lists/oss-security/2023/11/24/1[WEB]
- https://github.com/advisories/GHSA-4vvc-r4p4-qgrr[ADVISORY]