{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42447", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-08-02T00:03:35.191Z", "datePublished": "2024-08-05T08:02:31.921Z", "dateUpdated": "2025-03-19T14:39:15.524Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/", "defaultStatus": "unaffected", "packageName": "apache-airflow-providers-fab", "product": "Apache Airflow Providers FAB", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "1.2.1", "status": "affected", "version": "1.2.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.</p><p>This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.&nbsp;&nbsp;</p><p>* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)</p><p>* FAB provider 1.2.0 affected all versions of Airflow.<br></p><p><span style=\"background-color: var(--wht);\">Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.</span><br></p><p>Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.</p>Also upgrading Apache Airflow to latest version available is recommended.<br><br><p>Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.&nbsp;</p><p>Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.</p><br>"}], "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."}], "metrics": [{"other": {"content": {"text": "low"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-08-05T08:02:31.921Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/airflow/pull/40784"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52"}], "source": {"discovery": "EXTERNAL"}, "title": "Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T08:03:26.302Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-19T14:38:49.072024Z", "id": "CVE-2024-42447", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-19T14:39:15.524Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T08:03:26.302Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-42447", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-19T14:38:49.072024Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-07T15:54:45.779Z"}}], "cna": {"title": "Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow", "source": {"discovery": "EXTERNAL"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "low"}}}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Airflow Providers FAB", "versions": [{"status": "affected", "version": "1.2.0", "versionType": "semver", "lessThanOrEqual": "1.2.1"}], "packageName": "apache-airflow-providers-fab", "collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/apache/airflow/pull/40784", "tags": ["patch"]}, {"url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.", "supportingMedia": [{"type": "text/html", "value": "<p>Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.</p><p>This issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.&nbsp;&nbsp;</p><p>* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)</p><p>* FAB provider 1.2.0 affected all versions of Airflow.<br></p><p><span style=\"background-color: var(--wht);\">Users who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.</span><br></p><p>Users who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.</p>Also upgrading Apache Airflow to latest version available is recommended.<br><br><p>Note: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.&nbsp;</p><p>Users are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.</p><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-08-05T08:02:31.921Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42447", "state": "PUBLISHED", "dateUpdated": "2025-03-19T14:39:15.524Z", "dateReserved": "2024-08-02T00:03:35.191Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2024-08-05T08:02:31.921Z", "assignerShortName": "apache"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "323D66FA-F34A-45A9-AE18-CBC2C11F4506", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:2.9.3:*:*:*:*:*:*:*", "matchCriteriaId": "72D10390-BAB9-4295-A395-BB062FCF5EF3", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "74B301FD-5C54-4477-93B6-3FA1816906B1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:apache:airflow:-:*:*:*:*:*:*:*", "matchCriteriaId": "3175F2AE-AD9F-4D30-A411-5989E0445678", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."}, {"lang": "es", "value": "Vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente en Apache Airflow Providers FAB. Este problema afecta a Apache Airflow Providers FAB: 1.2.1 (cuando se utiliza con Apache Airflow 2.9.3) y FAB 1.2.0 para todas las versiones de Airflow. El proveedor FAB imped\u00eda que el usuario cerrara sesi\u00f3n. * El proveedor FAB 1.2.1 solo afectaba a Airflow 2.9.3 (las versiones anteriores y posteriores de Airflow no se ven afectadas) * El proveedor FAB 1.2.0 afect\u00f3 a todas las versiones de Airflow. Se recomienda a los usuarios que ejecutan Apache Airflow 2.9.3 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Se recomienda a los usuarios que ejecutan cualquier versi\u00f3n de Apache Airflow y tienen el proveedor FAB 1.2.0 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Tambi\u00e9n se recomienda actualizar Apache Airflow a la \u00faltima versi\u00f3n disponible. Nota: Las versiones anteriores de las im\u00e1genes de contenedor de referencia de Airflow 2.9.3 y los archivos de restricciones conten\u00edan la versi\u00f3n 1.2.1 del proveedor FAB, pero esto se solucion\u00f3 en las versiones actualizadas de las im\u00e1genes. Se recomienda a los usuarios que obtengan las im\u00e1genes m\u00e1s recientes de Airflow o que reinstalen el proveedor FAB seg\u00fan las restricciones actuales."}], "id": "CVE-2024-42447", "lastModified": "2025-03-19T15:15:49.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-05T08:15:56.397", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/apache/airflow/pull/40784"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security@apache.org", "type": "Secondary"}]}

{}