x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-46288

[GoVulnBot]

CVE-2023-46288 references github.com/apache/airflow, which may be a Go module.

Description:
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.4.0 to 2.7.0.

Sensitive configuration information has been exposed to authenticated users with the ability to read configuration via Airflow REST API for configuration even when the expose_config option is set to non-sensitive-only. The expose_config option is False by default. It is recommended to upgrade to a version that is not affected if you set expose_config to non-sensitive-only configuration. This is a different error than CVE-2023-45348 which allows authenticated user to retrieve individual configuration values in 2.7.* by specially crafting their request (solved in 2.7.2).

Users are recommended to upgrade to version 2.7.2, which fixes the issue and additionally fixes CVE-2023-45348.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-46288
• JSON: https://github.com/CVEProject/cvelist/tree/7f3fc681d298944401972d8bfbf92e9224f673af/2023/46xxx/CVE-2023-46288.json
• fix: fix(api_connexion): handle the cases that webserver.expose_config is set to "non-sensitive-only" instead of boolean value apache/airflow#32261
• web: https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw
• web: http://www.openwall.com/lists/oss-security/2024/04/17/10
• Imported by: https://pkg.go.dev/github.com/apache/airflow?tab=importedby

Cross references:

• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50943 #2473 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50944 #2474 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-51702 #2475 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-27906 #2586 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-26280 #2596 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-28746 #2680 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-29735 #2681 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/apache/airflow
      vulnerable_at: 1.8.2
      packages:
        - package: Apache Airflow
summary: CVE-2023-46288 in github.com/apache/airflow
cves:
    - CVE-2023-46288
references:
    - fix: https://github.com/apache/airflow/pull/32261
    - web: https://lists.apache.org/thread/yw4vzm0c5lqkwm0bxv6qy03yfd1od4nw
    - web: http://www.openwall.com/lists/oss-security/2024/04/17/10
source:
    id: CVE-2023-46288

[gopherbot]

Change https://go.dev/cl/584376 mentions this issue: data/excluded: batch add 3 excluded reports