/
DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CGA-3wwg-696x-xh4j

Published

Last updated

https://images.chainguard.dev/security/CGA-3wwg-696x-xh4j
Package

airflow-core-2

Repository

Chainguard

Latest Update
Pending upstream fix
Aliases
  • CVE-2024-34069
  • GHSA-2g68-c3qc-8985

Severity

7.5

High

CVSS V3

References

  • https://nvd.nist.gov/vuln/detail/CVE-2024-34069

Updates

Status

Pending upstream fix

Impact

The werkzeug debugger RCE vulnerability (CVE-2024-34069) requires werkzeug 3.0.3+. However, airflow 2.11.0 requires werkzeug<3,>=2.0, and its dependency Connexion 2.14.2 requires werkzeug<2.3,>=1.0. Upgrading werkzeug to 3.0.3+ breaks both airflow and Connexion compatibility. The fix requires upstream airflow to update to support werkzeug 3.x and update or remove the Connexion dependency.

Status

Under investigation

Status

Fixed

Fixed version

2.11.0-r2

Status

Under investigation


Safe Source for Open Source™
Contact us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Product

Chainguard ContainersChainguard LibrariesChainguard VMsIntegrationsPricing