Description
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | 2.2.4 – < Apache Airflow* | Apache Airflow* |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | >= 2.2.4, < 2.3.4rc1 | 2.3.4rc1 | GHSA-5ff8-7639-6v6g |