GitHub Advisoryadvisory · PyPI

GHSA-666g-rfc5-c9jv Apache Airflow Celery provider Insertion of Sensitive Information into Log File vulnerability

HIGH Published 2023-10-28 Modified 2025-02-13 Official page ↗
Aliases
CVE-2023-46215
Ecosystem
PyPI
Packages
apache-airflow-providers-celery, apache-airflow
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2023-10-31

Affected packages

• PyPI apache-airflow-providers-celery: >= 3.3.0, < 3.4.1 → fixed in 3.4.1 • PyPI apache-airflow: >= 1.10.0, < 2.7.0 → fixed in 2.7.0

Description

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2023-46215 Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References