Description
In Apache Airflow, prior to version 2.4.1, deactivating a user wouldn't prevent an already authenticated user from being able to continue using the UI or API.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Airflow | unspecified – ≤ 2.4.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-airflow | < 2.4.1rc1 | 2.4.1rc1 | GHSA-3q8r-f3pj-3gc4 |
| PyPI | apache-airflow | < 2.4.2rc1 | 2.4.2rc1 | PYSEC-2022-42983 |