id: PYSEC-2018-45
details: 'It was noticed an XSS in certain 404 pages that could be exploited to perform
  an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the
  page from loading. Firefox and other browsers don''t, and are vulnerable to this
  attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.'
affected:
- package:
    name: apache-airflow
    ecosystem: PyPI
    purl: pkg:pypi/apache-airflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.9.0
  versions:
  - 1.8.1
  - 1.8.2
  - 1.8.2rc1
references:
- type: WEB
  url: 
    https://lists.apache.org/thread.html/2c72480c76619c5e7793f0d213c34082f0598eaa4d212172f068940f@%3Cdev.airflow.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-rv25-9wgj-xg75
aliases:
- CVE-2017-12614
- GHSA-rv25-9wgj-xg75
modified: "2021-07-05T00:01:16.968952Z"
published: "2018-08-06T13:29:00Z"