GHSA-q4xr-rc97-m4xx
OS Command Injection in celery
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2021-23727
- Alias
- PYSEC-2021-858, SNYK-PYTHON-CELERY-2314953
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Paquets affectés
| Paquet | Versions |
|---|---|
| PyPI · celery | introduced 0, fixed 5.2.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2021-23727 ADVISORY
- https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b WEB
- https://github.com/advisories/GHSA-q4xr-rc97-m4xx ADVISORY
- https://github.com/celery/celery PACKAGE
- https://github.com/celery/celery/blob/master/Changelog.rst%23522 WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5 WEB
- https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |