CVE-2020-17511

published 2020-12-14

CVE-2020-17511: In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase…

medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

In Airflow versions prior to 1.10.13, when creating a user using airflow CLI, the password gets logged in plain text in the Log table in Airflow Metadatase. Same happened when creating a Connection with a password field.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	airflow	< 1.10.13	1.10.13
apache_software_foundation	apache_airflow	>= Apache Airflow < 1.10.13	1.10.13

CWE-312