Headline
GHSA-5ff8-7639-6v6g: Apache Airflow Session Fixation vulnerability
In Apache Airflow versions 2.2.4 through 2.3.3, the database webserver session backend was susceptible to session fixation.
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2022-38054
Apache Airflow Session Fixation vulnerability
Critical severity GitHub Reviewed Published Sep 3, 2022 • Updated Sep 15, 2022
Package
pip apache-airflow (pip)
Affected versions
>= 2.2.4, < 2.3.4rc1
Patched versions
2.3.4rc1
Description
Related news
CVE-2022-38054
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.