Improper Certificate Validation in Apache Airflow · CVE-2018-20245 · GitHub Advisory Database · GitHub

Improper Certificate Validation in Apache Airflow

High severity GitHub Reviewed Published Jan 25, 2019 to the GitHub Advisory Database • Updated Apr 4, 2024

Package

apache-airflow (pip)

Affected versions

< 1.10.1

Patched versions

1.10.1

Description

The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.

References

Published to the GitHub Advisory Database Jan 25, 2019

Reviewed Jun 16, 2020

Last updated Apr 4, 2024

Severity

High

7.5

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N