Description
A number of HTTP endpoints in the Airflow webserver (both RBAC and classic) did not have adequate protection and were vulnerable to cross-site request forgery attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Apache Airflow | Apache Airflow <= 1.10.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 1.10.3 | 1.10.3 | GHSA-w6j4-3gh2-9f5j |
| PyPI | apache-airflow | < 1.10.3b1 | 1.10.3b1 | PYSEC-2019-215 |