MEDIUM5.4

PYSEC-2024-264

Details

Apache Airflow version 2.9.0 has a vulnerability that allows an authenticated attacker to inject malicious data into the task instance logs. Users are recommended to upgrade to version 2.9.1, which fixes this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow

Introduced in: 0

No fixed version published yet for apache-airflow (pip). Pin to a known-safe version or switch to an alternative.

References

http://www.openwall.com/lists/oss-security/2024/05/14/1[ADVISORY]
https://lists.apache.org/thread/gsjmnrqb3m5fzp0vgpty1jxcywo91v77[ADVISORY]
https://github.com/apache/airflow/pull/38882[FIX]
https://github.com/advisories/GHSA-52gm-qmg3-r4qp[ADVISORY]