Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Apache Airflow 2.7.0 Clear all filters
TI-2023-20577 CVE-2023-39441 · GHSA-5f35-pq34-c87q

Improper certificate validation in Apache Airflow SMTP Provider

Priority LOW 28

Apache Airflow SMTP Provider before 1.3.0, Apache Airflow IMAP Provider before 3.3.0, and Apache Airflow before 2.7.0 are affected by the Validation of OpenSSL Certificate vulnerability.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00804 Published 2023-08-23 Fixed in 1.30, 3.3.0 +2 CWE-295
TI-2023-21115 CVE-2023-40273 · GHSA-pm87-24wq-r8w9

Session fixation in Apache Airflow web interface

Priority MEDIUM 41

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.01845 Published 2023-08-23 Fixed in 2.7.0, 2.7.0rc2 CWE-384