Non-encrypted confidential information In apache-airflow
Description
Apache Airflow logs passwords in plaintext In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. The same happenes when creating a Connection with a password field.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 pypi | 1.10.13 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.