Vulnerability · Published Jun 14, 2024 · Assigned by apache
CVE-2024-25142Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache
Medium 5.5
In plain English
A medium-severity security flaw in Apache Airflow from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow. Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-airflow | 2.9.2 | GHSA-9xpj-62mm-24h2 |
| PyPI | apache-airflow | 2.9.2 | PYSEC-2024-195 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Airflow | 0 – before 2.9.2 |
Weakness: CWE-525 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N