{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-06-25T06:35:28.496","vulnerabilities":[{"cve":{"id":"CVE-2024-42447","sourceIdentifier":"security@apache.org","published":"2024-08-05T08:15:56.397","lastModified":"2026-06-17T07:49:28.000","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB.\n\nThis issue affects Apache Airflow Providers FAB: 1.2.1 (when used with Apache Airflow 2.9.3) and FAB 1.2.0 for all Airflow versions. The FAB provider prevented the user from logging out.  \n\n* FAB provider 1.2.1 only affected Airflow 2.9.3 (earlier and later versions of Airflow are not affected)\n\n* FAB provider 1.2.0 affected all versions of Airflow.\n\nUsers who run Apache Airflow 2.9.3 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nUsers who run Any Apache Airflow version and have FAB provider 1.2.0 are recommended to upgrade to Apache Airflow Providers FAB version 1.2.2 which fixes the issue.\n\nAlso upgrading Apache Airflow to latest version available is recommended.\n\nNote: Early version of Airflow reference container images of Airflow 2.9.3 and constraint files contained FAB provider 1.2.1 version, but this is fixed in updated versions of the images. \n\nUsers are advised to pull the latest Airflow images or reinstall FAB provider according to the current constraints."},{"lang":"es","value":"Vulnerabilidad de expiración de sesión insuficiente en Apache Airflow Providers FAB. Este problema afecta a Apache Airflow Providers FAB: 1.2.1 (cuando se utiliza con Apache Airflow 2.9.3) y FAB 1.2.0 para todas las versiones de Airflow. El proveedor FAB impedía que el usuario cerrara sesión. * El proveedor FAB 1.2.1 solo afectaba a Airflow 2.9.3 (las versiones anteriores y posteriores de Airflow no se ven afectadas) * El proveedor FAB 1.2.0 afectó a todas las versiones de Airflow. Se recomienda a los usuarios que ejecutan Apache Airflow 2.9.3 que actualicen a Apache Airflow Providers FAB versión 1.2.2, que soluciona el problema. Se recomienda a los usuarios que ejecutan cualquier versión de Apache Airflow y tienen el proveedor FAB 1.2.0 que actualicen a Apache Airflow Providers FAB versión 1.2.2, que soluciona el problema. También se recomienda actualizar Apache Airflow a la última versión disponible. Nota: Las versiones anteriores de las imágenes de contenedor de referencia de Airflow 2.9.3 y los archivos de restricciones contenían la versión 1.2.1 del proveedor FAB, pero esto se solucionó en las versiones actualizadas de las imágenes. Se recomienda a los usuarios que obtengan las imágenes más recientes de Airflow o que reinstalen el proveedor FAB según las restricciones actuales."}],"affected":[{"source":"security@apache.org","affectedData":[{"vendor":"Apache Software Foundation","product":"Apache Airflow Providers FAB","defaultStatus":"unaffected","collectionURL":"https://pypi.org/project/apache-airflow-providers-fab/","packageName":"apache-airflow-providers-fab","versions":[{"version":"1.2.0","lessThanOrEqual":"1.2.1","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-03-19T14:38:49.072024Z","id":"CVE-2024-42447","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@apache.org","type":"Secondary","description":[{"lang":"en","value":"CWE-613"}]}],"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.1:*:*:*:*:*:*:*","matchCriteriaId":"323D66FA-F34A-45A9-AE18-CBC2C11F4506"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:apache:airflow:2.9.3:*:*:*:*:*:*:*","matchCriteriaId":"72D10390-BAB9-4295-A395-BB062FCF5EF3"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:apache:apache-airflow-providers-fab:1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"74B301FD-5C54-4477-93B6-3FA1816906B1"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:a:apache:airflow:-:*:*:*:*:*:*:*","matchCriteriaId":"3175F2AE-AD9F-4D30-A411-5989E0445678"}]}]}],"references":[{"url":"https://github.com/apache/airflow/pull/40784","source":"security@apache.org","tags":["Issue Tracking","Patch"]},{"url":"https://lists.apache.org/thread/2zoo8cjlwfjhbfdxfgltcm0hnc0qmc52","source":"security@apache.org","tags":["Mailing List","Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/04/2","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}