Componentpedia / Listings / apache-airflow-providers-fab / 1.1.1

Last update: 06/02/2025

apache-airflow-providers-fab

Apache Airflow - A platform to programmatically author, schedule, and monitor workflows

Version: 1.1.1 registry icon
Safety score
95
Check your open source dependency risks. Get immediate insight about security, stability and licensing risks.
De-risk your app now
Security Risks of Known Vulnerabilities
CVE-2024-45033
CWE-613
Threat level: LOW | CVSS score: 2

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider.

This issue affects Apache Airflow Fab Provider: before 1.5.2.

When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from  CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9  which was addressed in Apache-Airflow 2.7.0

Users are recommended to upgrade to version 1.5.2, which fixes the issue.


Please note that this component is affected by other vulnerabilities
Critical  |  High  |  Medium  |  Low  |  Suggest

Latest safe minor: 1.5.2 - Latest safe major: 2.0.0rc1 Scan your application codebase with Meterian to see all known vulnerabilities in your open source software dependencies.


Stability

Stay updated with the latest patches and releases. Plan your sofware desisgn. Avoid common known vulnerabilities fixed by the open source community

Latest patch release:   --

Latest minor release:   1.5.2

Latest major release:   2.0.0rc1

Licensing

Maintain your licence declarations and avoid unwanted licences to protect your IP the way you intended.

Apache-1.0   -   Apache License 1.0

Not a wildcard

Not proprietary

OSI Compliant