CVE-2023-46215

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-46215
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46215.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-46215
Aliases
Downstream
Published
2023-10-28T07:10:57.943Z
Modified
2026-07-08T07:34:33.709143752Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend
Details

Insertion of Sensitive Information into Log File vulnerability in Apache Airflow Celery provider, Apache Airflow.

Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backend Note: the vulnerability is about the information exposed in the logs not about accessing the logs.

This issue affects Apache Airflow Celery provider: from 3.3.0 through 3.4.0; Apache Airflow: from 1.10.0 through 2.6.3.

Users are recommended to upgrade Airflow Celery provider to version 3.4.1 and Apache Airlfow to version 2.7.0 which fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46215.json",
    "cna_assigner": "apache",
    "cwe_ids": [
        "CWE-532"
    ]
}
References

Affected packages

Git / github.com/apache/airflow

Affected ranges

Type
GIT
Repo
https://github.com/apache/airflow
Events
Introduced
b0057c29de1676435501f7af49143a8d008c7daa
Fixed
75c60923e01375ffc5f71c4f2f7968f489e2ca2f
Introduced
fcd3c0149f17b364dfb94c0523d23e3145976bbe
Database specific 
{
    "cpe": [
        "cpe:2.3:a:apache:airflow:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:apache:airflow_celery_provider:*:*:*:*:*:*:*:*"
    ],
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "1.10.0"
        },
        {
            "fixed": "2.7.0"
        },
        {
            "introduced": "3.3.0"
        },
        {
            "last_affected": "3.4.0"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-46215.json"