HIGH7.7

PYSEC-2020-22

Quick fix

PYSEC-2020-22 — apache-airflow: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow>=1.10.14'

Details

Incorrect Session Validation in Apache Airflow Webserver versions prior to 1.10.14 with default config allows a malicious airflow user on site A where they log in normally, to access unauthorized Airflow Webserver on Site B through the session from Site A. This does not affect users who have changed the default value for `[webserver] secret_key` config.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow

Introduced in: 0Fixed in: 1.10.14

Fixpip install --upgrade 'apache-airflow>=1.10.14'

References

https://lists.apache.org/thread.html/rbeeb73a6c741f2f9200d83b9c2220610da314810c4e8c9cf881d47ef%40%3Cusers.airflow.apache.org%3E[WEB]
http://www.openwall.com/lists/oss-security/2020/12/21/1[WEB]
https://github.com/advisories/GHSA-7mx5-x372-xh87[ADVISORY]