CVE-2023-46215
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow. Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs. This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3. Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.21% probability · 67th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-532
- Affected
- apache/airflow · apache/airflow celery provider
- Source
- security@apache.org
References
- http://www.openwall.com/lists/oss-security/2023/10/28/1Mailing List, Third Party Advisory
- https://github.com/apache/airflow/pull/34954Patch
- https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46nMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2023/10/28/1Mailing List, Third Party Advisory
- https://github.com/apache/airflow/pull/34954Patch
- https://lists.apache.org/thread/wm1jfmks7r6m7bj0mq4lmw3998svn46nMailing List, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.