GHSA-w6j4-3gh2-9f5j

Apache Airflow vulnerable to CSRF Attacks

Source: GitHub Advisory Database (reviewed) High CVE-2019-0229

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	apache-airflow	< 1.10.3	1.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-0229 advisory
https://github.com/advisories/GHSA-w6j4-3gh2-9f5j advisory
https://github.com/apache/airflow package
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2019-215.yaml web
https://lists.apache.org/thread.html/2de387213d45bc626d27554a1bde7b8c67d08720901f82a50b6f4231@%3Cdev.airflow.apache.org%3E web
https://web.archive.org/web/20200227081055/http://www.securityfocus.com/bid/107869 web
http://www.openwall.com/lists/oss-security/2019/04/10/6 web