Skip to content
OpenAdvisories
Medium · 5.3 CVE-2020-17513 BIT-airflow-2020-17513EUVD-2020-0039GHSA-6r3p-fcvm-xh7cPYSEC-2020-20

SSRF vulnerability in Apache Airflow

Published Dec 14, 2020 · Updated Feb 13, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow versions prior to 1.10.13, the Charts and Query View of the old (Flask-admin based) UI were vulnerable for SSRF attack.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow Apache Airflow – < 1.10.13 1.10.13

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow < 1.10.13 1.10.13 GHSA-6r3p-fcvm-xh7c

Advisories 1

References