/
DirectorySecurity AdvisoriesPricing
Sign in
Security Advisories

CGA-3wwg-696x-xh4j

Published

Last updated

https://images.chainguard.dev/security/CGA-3wwg-696x-xh4j
Package

airflow-core-2

Repository

Chainguard

Latest Update
Pending upstream fix
Aliases
  • CVE-2024-34069
  • GHSA-2g68-c3qc-8985

Severity

7.5

High

CVSS V3

References

  • https://nvd.nist.gov/vuln/detail/CVE-2024-34069

Updates

Status

Pending upstream fix

Impact

The werkzeug debugger RCE vulnerability (CVE-2024-34069) requires werkzeug 3.0.3+. However, airflow 2.11.0 requires werkzeug<3,>=2.0, and its dependency Connexion 2.14.2 requires werkzeug<2.3,>=1.0. Upgrading werkzeug to 3.0.3+ breaks both airflow and Connexion compatibility. The fix requires upstream airflow to update to support werkzeug 3.x and update or remove the Connexion dependency.

Status

Under investigation

Status

Fixed

Fixed version

2.11.0-r2

Status

Under investigation


The trusted source for open source

Talk to an expert
© 2025 Chainguard. All Rights Reserved.
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsIntegrationsPricing