CVE-2023-45348: Apache Airflow - Sensitive Configuration Information Disclosure
Summary
CVE-2023-45348: Apache Airflow: Configuration information leakage vulnerability. Affects airflow versions >= 2.7.0, < 2.7.2. Fixed in 2.7.2. How to fix ↓
Also tracked for
- apache-airflow · PyPI
- apache-airflow · PyPI
The same CVE-2023-45348 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating data pipelines. The vulnerability affects versions 2.7.0 and 2.7.1 of Apache Airflow. By default, the 'expose_config' option is set to False, preventing the exposure of sensitive configuration information. However, when this option is set to 'non-sensitive-only' by an authenticated user, the vulnerability allows the retrieval of sensitive configuration information.
Vulnerability Detail
The vulnerability in Apache Airflow allows an authenticated user to access sensitive configuration information when the 'expose_config' option is set to 'non-sensitive-only'. This can lead to the exposure of sensitive data, such as database credentials or API keys, which can be used for unauthorized access or further attacks. The impact of this vulnerability depends on the sensitivity of the configuration information stored in Apache Airflow.
How To Fix
Minimum fixed version
2.7.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can ensure that the 'expose_config' option is set to False, which is the default value. This can be done by modifying the configuration file or using the Airflow CLI command 'airflow config set core expose_config False'. By keeping the 'expose_config' option set to False, the sensitive configuration information will not be exposed even if an authenticated user attempts to change the value to 'non-sensitive-only'.
Conclusion
Apache Airflow versions 2.7.0 and 2.7.1 are vulnerable to the disclosure of sensitive configuration information when the 'expose_config' option is set to 'non-sensitive-only'. It is crucial to upgrade to a version that is not affected, such as version 2.7.2, to mitigate the risk of unauthorized access to sensitive data. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for airflow →
FAQ
Apache Airflow is an open-source platform used for programmatically authoring, scheduling, and monitoring workflows. It provides a rich set of features for managing and orchestrating data pipelines.
Versions 2.7.0 and 2.7.1 of Apache Airflow are affected by this vulnerability.
The default value of the 'expose_config' option in Apache Airflow is False, which prevents the exposure of sensitive configuration information.
To fix this vulnerability, it is recommended to upgrade to version 2.7.2 or any subsequent version of Apache Airflow.
Yes, as a workaround, users can ensure that the 'expose_config' option is set to False to prevent the exposure of sensitive configuration information.
Related vulnerabilities
Recent vulnerabilities recorded for airflow.
