MEDIUM6.1
PYSEC-2022-42970
Quick fix
PYSEC-2022-42970 — apache-airflow: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-airflow>=2.4.2'Details
In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l[REPORT]
- https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l[ARTICLE]
- https://lists.apache.org/thread/vqnvdrfsw9z7v7c46qh3psjgr7wy959l[ADVISORY]
- https://github.com/apache/airflow/pull/27143[REPORT]
- https://github.com/apache/airflow/pull/27143[WEB]
- https://github.com/advisories/GHSA-h63r-9xxf-f2c7[ADVISORY]