id: PYSEC-2019-149
details: In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed
  authenticated cookies, as well as passwords to databases used by Airflow. An attacker
  who has limited access to airflow, whether it be via XSS or by leaving a machine
  unlocked can exfiltrate all credentials from the system.
affected:
- package:
    name: apache-airflow
    ecosystem: PyPI
    purl: pkg:pypi/apache-airflow
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 1.9.0
  versions:
  - 1.8.1
  - 1.8.2
  - 1.8.2rc1
references:
- type: WEB
  url: https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E
- type: ADVISORY
  url: https://github.com/advisories/GHSA-9gqg-3fxr-9hv7
aliases:
- CVE-2017-17836
- GHSA-9gqg-3fxr-9hv7
modified: '2021-07-05T00:01:17.060541Z'
published: '2019-01-23T17:29:00Z'