HIGH8.1

PYSEC-2024-46

Quick fix

PYSEC-2024-46 — apache-airflow: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-airflow>=2.8.3rc1'

Details

Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access.

Users of Apache Airflow are recommended to upgrade to version 2.8.3 or newer to mitigate the risk associated with this vulnerability

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-airflow

Introduced in: 2.8.0Fixed in: 2.8.3rc1

Fixpip install --upgrade 'apache-airflow>=2.8.3rc1'

References

https://github.com/apache/airflow/pull/37881[WEB]
https://lists.apache.org/thread/b4pffc7w7do6qgk4jjbyxvdz5odrvny7[WEB]
https://github.com/advisories/GHSA-h574-6646-vfxx[ADVISORY]