MEDIUM6.1
PYSEC-2022-42984
Quick fix
PYSEC-2022-42984 — apache-airflow: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-airflow>=2.4.3'Details
In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/apache/airflow/pull/27576[FIX]
- https://github.com/apache/airflow/pull/27576[WEB]
- https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh[ARTICLE]
- https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh[ADVISORY]
- http://www.openwall.com/lists/oss-security/2022/11/15/1[ARTICLE]
- http://www.openwall.com/lists/oss-security/2022/11/15/1[WEB]
- https://github.com/advisories/GHSA-rg94-84xj-7gq3[ADVISORY]