HIGH8.8

PYSEC-2019-215

Quick fix

PYSEC-2019-215 — apache-airflow: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow>=1.10.3b1'

Details

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow

Introduced in: 0Fixed in: 1.10.3b1

Fixpip install --upgrade 'apache-airflow>=1.10.3b1'

References

https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E[WEB]
http://www.openwall.com/lists/oss-security/2019/04/10/6[WEB]
http://www.securityfocus.com/bid/107869[WEB]
https://github.com/advisories/GHSA-w6j4-3gh2-9f5j[ADVISORY]