What is GHSA-cvcq-gmc3-q6m8?

GHSA-cvcq-gmc3-q6m8 is a security advisory published by GitHub Security Advisories with Low severity. Apache Airflow logs passwords in plaintext

Which CVE IDs does GHSA-cvcq-gmc3-q6m8 cover?

GHSA-cvcq-gmc3-q6m8 covers the following CVE IDs: CVE-2020-17511. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-cvcq-gmc3-q6m8?

GHSA-cvcq-gmc3-q6m8 has a CVSS v3 base score of 2.8, published by GitHub Security Advisories.

Which products are affected by GHSA-cvcq-gmc3-q6m8?

GHSA-cvcq-gmc3-q6m8 affects 1 product, including: pip/apache-airflow:\u003c 1.10.13.

GHSA-cvcq-gmc3-q6m8LowCVSS 2.8

Apache Airflow logs passwords in plaintext

Vendor

GitHub Security Advisories

Published

December 17, 2020

Last Modified

September 11, 2024

🔗 CVE IDs covered (1)

CVE-2020-17511 →

📋 Description

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. The same happenes when creating a Connection with a password field.

🎯 Affected products1

pip/apache-airflow:< 1.10.13

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-17511
https://github.com/apache/airflow/commit/4e32546faf227a6497ce8b282fff7450cae6f665
https://lists.apache.org/thread.html/ree782a29d927b96bf0b39fb92e2f1f09ea3112a985f7a08ce93765ac%40%3Cusers.airflow.apache.org%3E
https://github.com/advisories/GHSA-cvcq-gmc3-q6m8
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-262.yaml