Skip to content
OpenAdvisories
High · 7.5 CVE-2022-40604 BIT-airflow-2022-40604EUVD-2022-0010GHSA-5rp4-749p-vx26PYSEC-2022-279

Format String Vulnerability

Published Sep 21, 2022 · Updated May 27, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Airflow Package: apache-airflow Ecosystem: PyPI

Description

In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Airflow unspecified – < 2.4.0, 2.3.0 – < unspecified 2.4.0

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI apache-airflow >= 2.3.0, < 2.4.0rc1 2.4.0rc1 GHSA-5rp4-749p-vx26
PyPI apache-airflow >= 2.3.0, < 2.4.0b1 2.4.0b1 PYSEC-2022-279

References