You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Kaxil Naik (JIRA)" <ji...@apache.org> on 2019/01/14 10:17:00 UTC
[jira] [Updated] (AIRFLOW-3700) Change the lowest allowed version
of "requests" to address security vulnerabilities
[ https://issues.apache.org/jira/browse/AIRFLOW-3700?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kaxil Naik updated AIRFLOW-3700:
--------------------------------
Fix Version/s: (was: 2.0.0)
1.10.2
> Change the lowest allowed version of "requests" to address security vulnerabilities
> -----------------------------------------------------------------------------------
>
> Key: AIRFLOW-3700
> URL: https://issues.apache.org/jira/browse/AIRFLOW-3700
> Project: Apache Airflow
> Issue Type: Improvement
> Components: dependencies
> Affects Versions: 1.10.1
> Reporter: Xiaodong DENG
> Assignee: Xiaodong DENG
> Priority: Critical
> Fix For: 1.10.2
>
>
> [https://nvd.nist.gov/vuln/detail/CVE-2018-18074]
>
> {color:#24292e}The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.{color}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)