You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@airflow.apache.org by "Xiaodong DENG (JIRA)" <ji...@apache.org> on 2019/01/14 01:39:00 UTC

[jira] [Created] (AIRFLOW-3700) Change the lowest allowed version of "requests" to address security vulnerabilities

Xiaodong DENG created AIRFLOW-3700:
--------------------------------------

             Summary: Change the lowest allowed version of "requests" to address security vulnerabilities
                 Key: AIRFLOW-3700
                 URL: https://issues.apache.org/jira/browse/AIRFLOW-3700
             Project: Apache Airflow
          Issue Type: Improvement
          Components: dependencies
    Affects Versions: 1.10.1
            Reporter: Xiaodong DENG
            Assignee: Xiaodong DENG


[https://nvd.nist.gov/vuln/detail/CVE-2018-18074]

 

{color:#24292e}The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.{color}



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)