logo

Database

Server-side request forgery (SSRF) In apache-airflow

Description

Apache Airflow Open Redirect vulnerability In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's /confirm endpoint.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-439852. NVD-2022-439853. OSV-2022-439854. GCVE-2022-43985

References

1. https://github.com/apache/airflow/pull/271432. https://github.com/apache/airflow/commit/9fb4814d29d934cef3b02fb3b2547f9fb76aaa973. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42971.yaml4. https://lists.apache.org/thread/m13y9s5kw92fw9l8j4qd85h0txp4kfcq

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.