From cc0a73a1ea323c34e6623274ece5434bf145ee77 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 11 Sep 2024 17:07:35 +0000
Subject: [PATCH] Publish GHSA-86vp-x3pr-79rx

---
 .../GHSA-86vp-x3pr-79rx.json                  | 86 +++++++++++--------
 1 file changed, 51 insertions(+), 35 deletions(-)

diff --git a/advisories/github-reviewed/2021/04/GHSA-86vp-x3pr-79rx/GHSA-86vp-x3pr-79rx.json b/advisories/github-reviewed/2021/04/GHSA-86vp-x3pr-79rx/GHSA-86vp-x3pr-79rx.json
index 9e3d2383892..f8386d08d60 100644
--- a/advisories/github-reviewed/2021/04/GHSA-86vp-x3pr-79rx/GHSA-86vp-x3pr-79rx.json
+++ b/advisories/github-reviewed/2021/04/GHSA-86vp-x3pr-79rx/GHSA-86vp-x3pr-79rx.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-86vp-x3pr-79rx",
-  "modified": "2024-03-25T15:44:15Z",
+  "modified": "2024-09-11T17:06:12Z",
   "published": "2021-04-20T16:40:14Z",
   "aliases": [
     "CVE-2020-17515"
   ],
-  "summary": "Apache Airflow Cross-site scripting due to incomplete fix for CVE-2020-13944",
-  "details": "The `origin` parameter passed to some of the endpoints like `/trigger` was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.14. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.",
+  "summary": "Apache Airflow cross-site scripting due to incomplete fix for CVE-2020-13944",
+  "details": "The `origin` parameter passed to some of the endpoints like `/trigger` was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.15. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.",
   "severity": [
     {
       "type": "CVSS_V3",
@@ -28,7 +28,7 @@
               "introduced": "0"
             },
             {
-              "fixed": "1.10.15"
+              "fixed": "1.10.15rc1"
             }
           ]
         }
@@ -44,10 +44,10 @@
           "type": "ECOSYSTEM",
           "events": [
             {
-              "introduced": "2.0.0"
+              "introduced": "2.0.0b1"
             },
             {
-              "fixed": "2.0.2"
+              "fixed": "2.0.2rc1"
             }
           ]
         }
@@ -76,40 +76,16 @@
       "url": "https://github.com/apache/airflow/commit/7486153f451e4d2bb1c6fd9cbb5a63430157c99c"
     },
     {
-      "type": "PACKAGE",
-      "url": "https://github.com/apache/airflow"
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/commit/ab8c55878e3e4257d2276226cb17b047ba856686"
     },
     {
       "type": "WEB",
-      "url": "https://github.com/apache/airflow/releases/tag/1.10.15"
+      "url": "https://github.com/apache/airflow/commit/c6369beed53d41c0a70415b0d958bf0604124ad7"
     },
     {
       "type": "WEB",
-      "url": "https://github.com/apache/airflow/releases/tag/2.0.2"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cannounce.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cdev.airflow.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cusers.airflow.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e@%3Cusers.airflow.apache.org%3E"
-    },
-    {
-      "type": "WEB",
-      "url": "https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E"
+      "url": "https://pypi.org/project/apache-airflow"
     },
     {
       "type": "WEB",
@@ -117,7 +93,47 @@
     },
     {
       "type": "WEB",
-      "url": "https://pypi.org/project/apache-airflow"
+      "url": "https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367@%3Cusers.airflow.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e@%3Cusers.airflow.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r4656959c8ed06c1f6202d89aa4e67b35ad7bdba5a666caff3fea888e%40%3Cusers.airflow.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cusers.airflow.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cdev.airflow.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://lists.apache.org/thread.html/r2892ef594dbbf54d0939b808626f52f7c2d1584f8aa1d81570847d2a@%3Cannounce.apache.org%3E"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/apache-airflow/PYSEC-2020-21.yaml"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/releases/tag/2.0.2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/apache/airflow/releases/tag/1.10.15"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/apache/airflow"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/advisories/GHSA-86vp-x3pr-79rx"
     },
     {
       "type": "WEB",