Apache Airflow Providers FAB Insufficient Session Expiration vulnerability
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.
This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.
-
FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)
-
FAB provider 1.2.0 affected all versions of Airflow.
Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.
Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.
Also upgrading Apache Airflow to latest version available is recommended.
Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.
Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | apache-airflow | <= 1.2.1, <= 1.2.0 | sin corrección |
| Python (PyPI) | apache-airflow-providers-fab | >= 1.2.0, < 1.2.2 | 1.2.2 |
Referencias
- http://www.openwall.com/lists/oss-security/2024/08/04/2
- https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52
- https://github.com/apache/airflow/pull/40784
- https://nvd.nist.gov/vuln/detail/CVE-2024-42447
- https://github.com/apache/airflow
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2024-265.yaml
- https://pypi.org/project/apache-airflow-providers-fab
- https://github.com/advisories/GHSA-62qf-qm3g-fvcw
- Vector CVSS
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N- Debilidad (CWE)
CWE-613- Plataforma
- Python (PyPI)
- Paquete
apache-airflow, apache-airflow-providers-fab- Publicada
- 05.08.2024
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2024-265 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2026-1146 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-62qf-qm3g-fvcw - CC BY 4.0
Historial de vulnerabilidades: apache-airflow-providers-fab
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 3
- Primera → última
- 08.2024 05.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Media 1
- Baja 2
Divulgaciones por año
- 2024: 1
- 2025: 1
- 2026: 1
-
Apache Airflow Providers FAB Insufficient Session Expiration vulnerability esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.