[<prev] [next>] [day] [month] [year] [list]
Message-ID: <368e93a0-58c9-3809-8e07-60e84ee50eb6@apache.org>
Date: Tue, 16 Jul 2024 12:06:38 +0000
From: Ephraim Anierobi <ephraimanierobi@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2024-39863: Apache Airflow: Potential XSS Vulnerability
Severity: low
Affected versions:
- Apache Airflow before 2.9.3
Description:
Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.
Credit:
Seokchan Yoon (https://github.com/ch4n3-yoon) (finder)
Amogh Desai (remediation developer)
References:
https://github.com/apache/airflow/pull/40475
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-39863
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
