What is GHSA-3q8r-f3pj-3gc4?

GHSA-3q8r-f3pj-3gc4 is a security advisory published by GitHub Security Advisories with High severity. Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

Which CVE IDs does GHSA-3q8r-f3pj-3gc4 cover?

GHSA-3q8r-f3pj-3gc4 covers the following CVE IDs: CVE-2022-41672. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3q8r-f3pj-3gc4?

GHSA-3q8r-f3pj-3gc4 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-3q8r-f3pj-3gc4?

GHSA-3q8r-f3pj-3gc4 affects 1 product, including: pip/apache-airflow:\u003c 2.4.1rc1.

GHSA-3q8r-f3pj-3gc4HighCVSS 8.1

Apache Airflow may allow authenticated users who have been deactivated to continue using the UI or API

Vendor

GitHub Security Advisories

Published

October 7, 2022

Last Modified

September 11, 2024

🔗 CVE IDs covered (1)

CVE-2022-41672 →

📋 Description

In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.

🎯 Affected products1

pip/apache-airflow:< 2.4.1rc1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2022-41672
https://github.com/apache/airflow/pull/26635
https://lists.apache.org/thread/ohf3pvd3dftb8zb01yngbn1jtkq5m08y
https://github.com/apache/airflow/commit/12bfb571a895a28a58d3189b0fc10cfc1b89e24c
https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2022-42983.yaml
https://github.com/advisories/GHSA-3q8r-f3pj-3gc4