Severity
High
Analysis Summary
CVE-2023-46215
Apache Airflow Celery provider and Apache Airflow could allow a remote attacker to obtain sensitive information, caused by the log of sensitive information in clear text when rediss, amqp, rpc protocols are used. By gaining access to the log file, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
Impact
- Information Disclosure
Indicators Of Compromise
CVE
- CVE-2023-46215
Affected Vendors
Apache
Affected Products
- Apache Airflow 1.10.0
- Apache Airflow 2.6.3
- Apache Airflow Celery provider 3.3.0
- Apache Airflow Celery provider 3.4.0
Remediation
Upgrade to the latest version of Airflow Celery provider and Airflow, available from the Apache Web site.