x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-31869

[GoVulnBot]

CVE-2024-31869 references github.com/apache/airflow, which may be a Go module.

Description:
Airflow versions 2.7.0 through 2.8.4 have a vulnerability that allows an authenticated user to see sensitive provider configuration via the "configuration" UI page when "non-sensitive-only" was set as "webserver.expose_config" configuration (The celery provider is the only community provider currently that has sensitive configurations). You should migrate to Airflow 2.9 or change your "expose_config" configuration to False as a workaround. This is similar, but different to CVE-2023-46288 GHSA-9qqg-mh7c-chfq which concerned API, not UI configuration page.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-31869
• JSON: https://github.com/CVEProject/cvelist/tree/4f678280c1dc71a8c25849524b6995947359d077/2024/31xxx/CVE-2024-31869.json
• fix: Load providers configuration when gunicorn workers start apache/airflow#38795
• web: https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3
• Imported by: https://pkg.go.dev/github.com/apache/airflow?tab=importedby

Cross references:

• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50943 #2473 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-50944 #2474 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2023-51702 #2475 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-27906 #2586 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-26280 #2596 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-28746 #2680 NOT_GO_CODE
• Module github.com/apache/airflow appears in issue x/vulndb: potential Go vuln in github.com/apache/airflow: CVE-2024-29735 #2681 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/apache/airflow
      vulnerable_at: 1.8.2
      packages:
        - package: Apache Airflow
summary: CVE-2024-31869 in github.com/apache/airflow
cves:
    - CVE-2024-31869
references:
    - fix: https://github.com/apache/airflow/pull/38795
    - web: https://lists.apache.org/thread/pz6vg7wcjk901rmsgt86h76g6kfcgtk3
source:
    id: CVE-2024-31869

[gopherbot]

Change https://go.dev/cl/590855 mentions this issue: data/excluded: add 20 excluded reports