{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C8968CDB-A1E9-4FB8-BE4D-4A0281470411",
              "versionEndExcluding": "1.5.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\n\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\n\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \u00a0which was addressed in Apache-Airflow 2.7.0\n\n\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de caducidad insuficiente de sesi\u00f3n en Apache Airflow Fab Provider. Este problema afecta a Apache Airflow Fab Provider: antes de 1.5.2. Cuando se ha cambiado la contrase\u00f1a de usuario con la CLI de administrador, las sesiones de ese usuario no se han borrado, lo que provoca una caducidad insuficiente de la sesi\u00f3n, por lo que los usuarios registrados pueden seguir conectados incluso despu\u00e9s de cambiar la contrase\u00f1a. Esto solo ocurre cuando se cambia la contrase\u00f1a con la CLI. El problema no ocurre en caso de que el cambio se haya realizado con el servidor web, por lo que es diferente de CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 que se abord\u00f3 en Apache-Airflow 2.7.0 Se recomienda a los usuarios que actualicen a la versi\u00f3n 1.5.2, que soluciona el problema."
    }
  ],
  "id": "CVE-2024-45033",
  "lastModified": "2025-06-03T21:11:55.067",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.1,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.2,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-01-08T09:15:07.290",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking"
      ],
      "url": "https://github.com/apache/airflow/pull/45139"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "security@apache.org",
      "type": "Secondary"
    }
  ]
}

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "323D66FA-F34A-45A9-AE18-CBC2C11F4506",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:airflow:2.9.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "72D10390-BAB9-4295-A395-BB062FCF5EF3",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "74B301FD-5C54-4477-93B6-3FA1816906B1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:apache:airflow:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "3175F2AE-AD9F-4D30-A411-5989E0445678",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de expiraci\u00f3n de sesi\u00f3n insuficiente en Apache Airflow Providers FAB. Este problema afecta a Apache Airflow Providers FAB: 1.2.1 (cuando se utiliza con Apache Airflow 2.9.3) y FAB 1.2.0 para todas las versiones de Airflow. El proveedor FAB imped\u00eda que el usuario cerrara sesi\u00f3n. * El proveedor FAB 1.2.1 solo afectaba a Airflow 2.9.3 (las versiones anteriores y posteriores de Airflow no se ven afectadas) * El proveedor FAB 1.2.0 afect\u00f3 a todas las versiones de Airflow. Se recomienda a los usuarios que ejecutan Apache Airflow 2.9.3 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Se recomienda a los usuarios que ejecutan cualquier versi\u00f3n de Apache Airflow y tienen el proveedor FAB 1.2.0 que actualicen a Apache Airflow Providers FAB versi\u00f3n 1.2.2, que soluciona el problema. Tambi\u00e9n se recomienda actualizar Apache Airflow a la \u00faltima versi\u00f3n disponible. Nota: Las versiones anteriores de las im\u00e1genes de contenedor de referencia de Airflow 2.9.3 y los archivos de restricciones conten\u00edan la versi\u00f3n 1.2.1 del proveedor FAB, pero esto se solucion\u00f3 en las versiones actualizadas de las im\u00e1genes. Se recomienda a los usuarios que obtengan las im\u00e1genes m\u00e1s recientes de Airflow o que reinstalen el proveedor FAB seg\u00fan las restricciones actuales."
    }
  ],
  "id": "CVE-2024-42447",
  "lastModified": "2025-03-19T15:15:49.917",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-08-05T08:15:56.397",
  "references": [
    {
      "source": "security@apache.org",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "url": "https://github.com/apache/airflow/pull/40784"
    },
    {
      "source": "security@apache.org",
      "tags": [
        "Mailing List",
        "Vendor Advisory"
      ],
      "url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"
    }
  ],
  "sourceIdentifier": "security@apache.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-613"
        }
      ],
      "source": "security@apache.org",
      "type": "Primary"
    }
  ]
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:03:26.302Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/08/04/2"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-42447",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-19T14:38:49.072024Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-19T14:39:15.524Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow Providers FAB",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "1.2.1",
              "status": "affected",
              "version": "1.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u0026nbsp;\u0026nbsp;\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\u003c/p\u003e\u003cp\u003e* FAB provider 1.2.0 affected all versions of Airflow.\u003cbr\u003e\u003c/p\u003e\u003cp\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\u003c/p\u003eAlso upgrading Apache Airflow to latest version available is recommended.\u003cbr\u003e\u003cbr\u003e\u003cp\u003eNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u0026nbsp;\u003c/p\u003e\u003cp\u003eUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints.\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.\u00a0\u00a0\n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images.\u00a0\n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613: Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-05T08:02:31.921Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/40784"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-42447",
    "datePublished": "2024-08-05T08:02:31.921Z",
    "dateReserved": "2024-08-02T00:03:35.191Z",
    "dateUpdated": "2025-03-19T14:39:15.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.1,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-45033",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-08T13:59:02.210778Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-08T13:59:37.707Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pypi.org/project/apache-airflow-providers-fab/",
          "defaultStatus": "unaffected",
          "packageName": "apache-airflow-providers-fab",
          "product": "Apache Airflow Fab Provider",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "1.5.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Saurabh Banawar"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eInsufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Airflow Fab Provider: before 1.5.2.\u003cbr\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u0026nbsp;\u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://github.com/advisories/GHSA-pm87-24wq-r8w9\"\u003eCVE-2023-40273\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;which was addressed in Apache-Airflow 2.7.0\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 1.5.2, which fixes the issue.\u003c/p\u003e"
            }
          ],
          "value": "Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.\n\nThis issue affects Apache Airflow Fab Provider: before 1.5.2.\n\nWhen user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from\u00a0 CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9 \u00a0which was addressed in Apache-Airflow 2.7.0\n\n\nUsers are recommended to upgrade to version 1.5.2, which fixes the issue."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "CWE-613 Insufficient Session Expiration",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-08T08:41:39.579Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/apache/airflow/pull/45139"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/yw535346rk766ybzpqtvrl36sjj789st"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-45033",
    "datePublished": "2025-01-08T08:41:39.579Z",
    "dateReserved": "2024-08-21T12:29:33.858Z",
    "dateUpdated": "2025-01-08T13:59:37.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}