SB2024111110 - Information disclosure in Apache Airflow

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2024-50378)

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive information into log files, when sensitive variables were set via airflow CLI. A remote user with audit log access can the audit log and gain access to sensitive data.

2) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2024-45784)

The vulnerability allows a local user to gain access to sensitive information.

The vulnerability exists due to software stores sensitive configuration variables into log files. A local user can read the log files and gain access to sensitive data.

Remediation

Install update from vendor's website.

References

• https://github.com/apache/airflow/pull/43123
• https://lists.apache.org/thread/q6rctpqh5z27l6tx4wgkxdcltmvtx6kd
• https://github.com/apache/airflow/pull/43040
• https://lists.apache.org/thread/k2jm55jztlbmk4zrlh10syvq3n57hl4h