CVE-2024-42447 (GCVE-0-2024-42447)

Vulnerability from cvelistv5 – Published: 2024-08-05 08:02 – Updated: 2025-03-19 14:39
VLAI?
Title
Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow
Summary
Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.   * FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected) * FAB provider 1.2.0 affected all versions of Airflow. Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue. Also upgrading Apache Airflow to latest version available is recommended. Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.  Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.
Severity ?
No CVSS data available.
CWE
  • CWE-613 - Insufficient Session Expiration
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache Airflow Providers FAB Affected: 1.2.0 , ≤ 1.2.1 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:03:26.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-42447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T14:38:49.072024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T14:39:15.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow Providers FAB",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.0 affected all versions of Airflow.\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/p\u003eAlso upgrading Apache Airflow to latest version available is recommended.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u0026nbsp;\u003c/p\u003e\u003cp\u003eUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-05T08:02:31.921Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/40784"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-42447",
    "datePublished": "2024-08-05T08:02:31.921Z",
    "dateReserved": "2024-08-02T00:03:35.191Z",
    "dateUpdated": "2025-03-19T14:39:15.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"323D66FA-F34A-45A9-AE18-CBC2C11F4506\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:apache:airflow:2.9.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72D10390-BAB9-4295-A395-BB062FCF5EF3\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"74B301FD-5C54-4477-93B6-3FA1816906B1\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:a:apache:airflow:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3175F2AE-AD9F-4D30-A411-5989E0445678\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\\n\\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\\u00a0\\u00a0\\n\\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\\n\\n* FAB provider 1.2.0 affected all versions of Airflow.\\n\\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nAlso upgrading Apache Airflow to latest version available is recommended.\\n\\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\\u00a0\\n\\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de expiraci\\u00f3n de sesi\\u00f3n insuficiente en Apache Airflow Providers FAB. Este problema afecta a Apache Airflow Providers FAB: 1.2.1 (cuando se utiliza con Apache Airflow 2.9.3) y FAB 1.2.0 para todas las versiones de Airflow. El proveedor FAB imped\\u00eda que el usuario cerrara sesi\\u00f3n. * El proveedor FAB 1.2.1 solo afectaba a Airflow 2.9.3 (las versiones anteriores y posteriores de Airflow no se ven afectadas) * El proveedor FAB 1.2.0 afect\\u00f3 a todas las versiones de Airflow. Se recomienda a los usuarios que ejecutan Apache Airflow 2.9.3 que actualicen a Apache Airflow Providers FAB versi\\u00f3n 1.2.2, que soluciona el problema. Se recomienda a los usuarios que ejecutan cualquier versi\\u00f3n de Apache Airflow y tienen el proveedor FAB 1.2.0 que actualicen a Apache Airflow Providers FAB versi\\u00f3n 1.2.2, que soluciona el problema. Tambi\\u00e9n se recomienda actualizar Apache Airflow a la \\u00faltima versi\\u00f3n disponible. Nota: Las versiones anteriores de las im\\u00e1genes de contenedor de referencia de Airflow 2.9.3 y los archivos de restricciones conten\\u00edan la versi\\u00f3n 1.2.1 del proveedor FAB, pero esto se solucion\\u00f3 en las versiones actualizadas de las im\\u00e1genes. Se recomienda a los usuarios que obtengan las im\\u00e1genes m\\u00e1s recientes de Airflow o que reinstalen el proveedor FAB seg\\u00fan las restricciones actuales.\"}]",
      "id": "CVE-2024-42447",
      "lastModified": "2024-11-21T09:34:02.990",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}]}",
      "published": "2024-08-05T08:15:56.397",
      "references": "[{\"url\": \"https://github.com/apache/airflow/pull/40784\", \"source\": \"security@apache.org\", \"tags\": [\"Issue Tracking\", \"Patch\"]}, {\"url\": \"https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\", \"Vendor Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/08/04/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-613\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-42447\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-08-05T08:15:56.397\",\"lastModified\":\"2025-03-19T15:15:49.917\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\\n\\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\\n\\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\\n\\n* FAB provider 1.2.0 affected all versions of Airflow.\\n\\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nAlso upgrading Apache Airflow to latest version available is recommended.\\n\\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\\n\\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente en Apache Airflow Providers FAB. Este problema afecta a Apache Airflow Providers FAB: 1.2.1 (cuando se utiliza con Apache Airflow 2.9.3) y FAB 1.2.0 para todas las versiones de Airflow. El proveedor FAB imped\u00eda que el usuario cerrara sesi\u00f3n. * El proveedor FAB 1.2.1 solo afectaba a Airflow 2.9.3 (las versiones anteriores y posteriores de Airflow no se ven afectadas) * El proveedor FAB 1.2.0 afect\u00f3 a todas las versiones de Airflow. Se recomienda a los usuarios que ejecutan Apache Airflow 2.9.3 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Se recomienda a los usuarios que ejecutan cualquier versi\u00f3n de Apache Airflow y tienen el proveedor FAB 1.2.0 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Tambi\u00e9n se recomienda actualizar Apache Airflow a la \u00faltima versi\u00f3n disponible. Nota: Las versiones anteriores de las im\u00e1genes de contenedor de referencia de Airflow 2.9.3 y los archivos de restricciones conten\u00edan la versi\u00f3n 1.2.1 del proveedor FAB, pero esto se solucion\u00f3 en las versiones actualizadas de las im\u00e1genes. Se recomienda a los usuarios que obtengan las im\u00e1genes m\u00e1s recientes de Airflow o que reinstalen el proveedor FAB seg\u00fan las restricciones actuales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-613\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"323D66FA-F34A-45A9-AE18-CBC2C11F4506\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:apache:airflow:2.9.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72D10390-BAB9-4295-A395-BB062FCF5EF3\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"74B301FD-5C54-4477-93B6-3FA1816906B1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:a:apache:airflow:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3175F2AE-AD9F-4D30-A411-5989E0445678\"}]}]}],\"references\":[{\"url\":\"https://github.com/apache/airflow/pull/40784\",\"source\":\"security@apache.org\",\"tags\":[\"Issue Tracking\",\"Patch\"]},{\"url\":\"https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/08/04/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/08/04/2\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-05T08:03:26.302Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 9.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42447\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-19T14:38:49.072024Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-07T15:54:45.779Z\"}}], \"cna\": {\"title\": \"Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow\", \"source\": {\"discovery\": \"EXTERNAL\"}, \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Airflow Providers FAB\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"1.2.1\"}], \"packageName\": \"apache-airflow-providers-fab\", \"collectionURL\": \"https://pypi.org/project/apache-airflow-providers-fab/\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/airflow/pull/40784\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\\n\\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\\u00a0\\u00a0\\n\\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\\n\\n* FAB provider 1.2.0 affected all versions of Airflow.\\n\\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\\n\\nAlso upgrading Apache Airflow to latest version available is recommended.\\n\\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\\u00a0\\n\\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.0 affected all versions of Airflow.\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003eUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/p\u003eAlso upgrading Apache Airflow to latest version available is recommended.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u0026nbsp;\u003c/p\u003e\u003cp\u003eUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-613\", \"description\": \"CWE-613: Insufficient Session Expiration\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-08-05T08:02:31.921Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42447\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-03-19T14:39:15.524Z\", \"dateReserved\": \"2024-08-02T00:03:35.191Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-08-05T08:02:31.921Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.