Ce mail provient de l'extérieur, restons vigilants

======================================================================

                               CERT-Renater

                     Note d'Information No. 2024/VULN474
_____________________________________________________________________

DATE                : 15/11/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Airflow versions prior
                                      to 2.10.3.

=====================================================================
https://lists.apache.org/thread/7z8ynvbr6fkznsm133fvw9dym31zy1rw
_____________________________________________________________________

CVE-2024-45784: Apache Airflow: Sensitive configuration values are
not masked in the logs by default
Severity: moderate

Affected versions:

- Apache Airflow before 2.10.3

Description:

Apache Airflow versions before 2.10.3 contain a vulnerability that
could expose sensitive configuration variables in task logs. This
vulnerability allows DAG authors to unintentionally or intentionally
log sensitive configuration variables. Unauthorized users could
access these logs, potentially exposing critical data that could be
exploited to compromise the security of the Airflow deployment.
In version 2.10.3, secrets are now masked in task logs to prevent
sensitive configuration variables from being exposed in the
logging output. Users should upgrade to Airflow 2.10.3 or the
latest version to eliminate this vulnerability. If you suspect that
DAG authors could have logged the secret values to the logs and that
your logs are not additionally protected, it is also recommended
that you update those secrets.


Credit:

Saurabh Banawar (finder)
Amogh Desai (remediation developer)


References:

https://github.com/apache/airflow/pull/43040
https://airflow.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-45784


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================