logo

Database

Insecure session management In apache-airflow

Description

Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2022-416722. NVD-2022-416723. OSV-2022-416724. GCVE-2022-41672

References

1. https://github.com/apache/airflow/pull/266352. https://github.com/apache/airflow/commit/12bfb571a895a28a58d3189b0fc10cfc1b89e24c3. https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42983.yaml4. https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.