Vulnerability in Flask-AppBuilder<=4.5.0

[Huthesh]

Hi Team,

All latest versions of airflow uses Flask-AppBuilder=4.5.0. As per GHSA-fw5r-6m3x-rh7p all version below 4.5.1 is impacted due to "Flask-AppBuilder's login form allows browser to cache sensitive fields". Is there plan to upgrade the Flask-AppBuilder's version.

if there is a plan when is it expected to be released? Is there a work around ?

[potiuk]

All latest versions of airflow uses Flask-AppBuilder=4.5.0.

Where did you get that information from? I am really curious @Huthesh - could you please elaborate on it ?

As of quite a few releases back, Airflow does NOT depend on FAB directly.

The depenedency has been moved to "apache-airflow-providers-fab" - and the latest "apache-airlfow-providers-fab" depends on FAB == 4.5.2 and since you can upgrade/downgrade FAB provider independently on Airflow, you should be be able to upgrade to the version - even if you do not want to upgrade to latest Airflow with all recommended versions of providers.

The - released yesterday - Airlfow 2.10.4 - for example - has FAB 4.5.2 included in the image.

[jarek:~/code/airflow-publish] main* 15s ± docker run -it apache/airflow:2.10.4 bash

airflow@cd8d11fc7b1d:/opt/airflow$ pip freeze | grep -i Flask
Flask==2.2.5
Flask-AppBuilder==4.5.2
Flask-Babel==2.0.0
Flask-Caching==2.3.0
Flask-JWT-Extended==4.7.1
Flask-Limiter==3.9.2
Flask-Login==0.6.3
Flask-Session==0.5.0
Flask-SQLAlchemy==2.5.1
Flask-WTF==1.2.2
airflow@cd8d11fc7b1d:/opt/airflow$ 

I would be really curious how you came to the conclusion that "All latest versions of airflow uses Flask-AppBuilder=4.5.0." - could you please explain exactly how you came to that conclusion ?

[Huthesh]

I checked the constraint file for latest releases in both 2.9.x and 2.10.x releases. The had version set as Flask-AppBuilder=4.5.0.

https://raw.githubusercontent.com/apache/airflow/constraints-2.10.4/constraints-3.8.txt here aswell Flask-AppBuilde is set to 4.5.0

I tried to upgrade the flask-appbuilder to 4.5.1, build are failing because of following error. We are using airflow 2.9.3

ERROR: ResolutionImpossible: for help visit https://pip.pypa.io/en/latest/topics/dependency-resolution/#dealing-with-dependency-conflicts
The conflict is caused by:    apache-airflow-providers-fab 1.2.2 depends on flask-appbuilder==4.5.0    The user requested (constraint) flask-appbuilder==4.5.1

since we are currently running on 2.9.3 is it safe to upgrade to 2.10.4?

[potiuk]

Read https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#constraints-files why we need constraints and what they are. the whole system is designed ai that you can upgrade/downgrade dependencies - including providers.
You should of course test it - surely you have staging system - and read release notes for providers when you upgrade (surely you are doing it already for all dependencies you upgrade in production as you should).

[potiuk]

Also see (same doc) where you can see various installation and upgrade scenarios about https://airflow.apache.org/docs/apache-airflow/stable/installation/installing-from-pypi.html#installation-and-upgrade-scenarios