Is CVE-2024-42447 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-42447 being exploited in the wild.

How severe is CVE-2024-42447?

Medium severity, with a CVSS score of 4.2, published 5 August 2024.

Which products and versions are affected?

Apache Software Foundation Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3); apache-airflow (PyPI) ECOSYSTEM:introduced=0,last_affected=1.2.1,last_affected=1.2.0; apache-airflow-providers-fab (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.2.2.

Is there a fix for CVE-2024-42447?

Yes. apache-airflow-providers-fab (PyPI): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-42447 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2024-42447?

Check whether you run Apache Software Foundation Airflow Providers FAB, apache-airflow (PyPI) or apache-airflow-providers-fab (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-42447: Apache Airflow Providers FAB insufficient session expiration

CVE-2024-42447 · Severity: medium · CVSS 4.2 · Published 2024-08-05

A vulnerability in the Apache Airflow FAB provider prevents users from properly logging out of the system. This means that if a user accesses Airflow from a shared or public computer, their session could remain active even after they attempt to sign out. An unauthorized person could potentially use the abandoned session to access sensitive data or perform actions on behalf of the original user.

Technologies: apache-airflow (PyPI), apache-airflow-providers-fab (PyPI). Vendors: Apache Software Foundation, PyPI.

Quick answers

Is CVE-2024-42447 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-42447 being exploited in the wild.
How severe is CVE-2024-42447?: Medium severity, with a CVSS score of 4.2, published 5 August 2024.
Which products and versions are affected?: Apache Software Foundation Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3); apache-airflow (PyPI) ECOSYSTEM:introduced=0,last_affected=1.2.1,last_affected=1.2.0; apache-airflow-providers-fab (PyPI) ECOSYSTEM:introduced=1.2.0,fixed=1.2.2.
Is there a fix for CVE-2024-42447?: Yes. apache-airflow-providers-fab (PyPI): upgrade to 1.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-42447 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2024-42447?: Check whether you run Apache Software Foundation Airflow Providers FAB, apache-airflow (PyPI) or apache-airflow-providers-fab (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

apache-airflow-providers-fab (PyPI): upgrade to 1.2.2 or later
```
pip install "apache-airflow-providers-fab>=1.2.2"
```

Technical details

An Insufficient Session Expiration vulnerability (CWE-613) exists in the Apache Airflow FAB (Flask AppBuilder) provider. The flaw is rooted in a version check logic error related to logout CSRF protection, which effectively prevents the logout mechanism from terminating the user session. The issue specifically affects FAB provider version 1.2.0 across all Airflow versions, and version 1.2.1 specifically when paired with Airflow 2.9.3. Attackers could leverage an unexpired session on a shared workstation to gain unauthorized access to the Airflow web interface. The issue is resolved in Apache Airflow Providers FAB version 1.2.2.

Affected products

Apache Airflow Providers FAB 1.2.0, 1.2.1 (when used with Airflow 2.9.3)

Identifiers

CVE-2024-42447
GHSA-62qf-qm3g-fvcw
PYSEC-2024-265
PYSEC-2026-1146

Timeline

2024-08-04: disclosed: Initial disclosure on oss-security mailing list
2024-08-05: advisory: GitHub and NVD advisories published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.