id: PYSEC-2021-434
details: Apache Superset up to and including 1.3.1 allowed for database connections
  password leak for authenticated users. This information could be accessed in a non-trivial
  way.
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.3.2
  versions:
  - 0.34.0
  - 0.34.1
  - 0.35.1
  - 0.35.2
  - 0.36.0
  - 0.37.0
  - 0.37.1
  - 0.37.2
  - 0.38.0
  - 0.38.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
references:
- type: WEB
  url: https://lists.apache.org/thread/xpdl2r538o695o7r9gd9qrwqb17bdd3v
- type: WEB
  url: https://seclists.org/oss-sec/2021/q4/106
- type: ADVISORY
  url: https://github.com/advisories/GHSA-42q4-9xf9-f67x
aliases:
- CVE-2021-41972
- GHSA-42q4-9xf9-f67x
modified: "2021-11-29T23:10:59.053614Z"
published: "2021-11-12T19:15:00Z"