logo

Database

Server-side request forgery (SSRF) In apache-airflow

Description

SSRF vulnerability in Apache Airflow In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2020-175132. NVD-2020-175133. OSV-2020-175134. GHSA-6r3p-fcvm-xh7c5. GCVE-2020-17513

References

1. https://github.com/apache/airflow/commit/b606b871226d649913a37fd074eeae5d86ebc3a12. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-20.yaml3. https://lists.apache.org/thread.html/rb3647269f07cc2775ca6568cbfd4994d862c842a58120d2aba9c658a%40%3Cusers.airflow.apache.org%3E

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.