MEDIUM6.1
PYSEC-2022-42971
Quick fix
PYSEC-2022-42971 — apache-airflow: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-airflow>=2.4.2'Details
In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq[REPORT]
- https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq[ARTICLE]
- https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq[ADVISORY]
- https://github.com/apache/airflow/pull/27143[REPORT]
- https://github.com/apache/airflow/pull/27143[FIX]
- https://github.com/apache/airflow/pull/27143[WEB]
- https://github.com/advisories/GHSA-f9fq-78ch-4wmj[ADVISORY]