{"id":"PYSEC-2022-279","details":"In Apache Airflow 2.3.0 through 2.3.4, part of a url was unnecessarily formatted, allowing for possible information extraction.","aliases":["BIT-airflow-2022-40604","CVE-2022-40604","GHSA-5rp4-749p-vx26"],"modified":"2023-12-06T01:02:34.763072Z","published":"2022-09-21T08:15:00Z","references":[{"type":"WEB","url":"https://lists.apache.org/thread/z20x8m16fnhxdkoollv53w1ybsts687t"},{"type":"WEB","url":"https://github.com/apache/airflow/pull/26337"}],"affected":[{"package":{"name":"apache-airflow","ecosystem":"PyPI","purl":"pkg:pypi/apache-airflow"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.4.0b1"}]}],"versions":["2.3.0","2.3.1","2.3.1rc1","2.3.2","2.3.2rc1","2.3.2rc2","2.3.3","2.3.3rc1","2.3.3rc2","2.3.3rc3","2.3.4","2.3.4rc1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/apache-airflow/PYSEC-2022-279.yaml"}}],"schema_version":"1.7.3"}