GitHub Advisoryadvisory · PyPI
GHSA-fvx8-v524-8579 django-celery-results Stores Sensitive Information In Cleartext
HIGH
Official page ↗
- Aliases
- CVE-2020-17495
- Ecosystem
- PyPI
- Packages
- django-celery-results
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-312
- Reviewed
- 2021-05-17
Affected packages
• PyPI django-celery-results: < 2.4.0 → fixed in 2.4.0
Description
django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
In version 2.4.0 this is no longer the default behaviour but can be re-enabled with the `result_extended` flag in which case care should be taken to ensure any sensitive variables are scrubbed - see here for an example.
Related
Alias · CVE (1)
- CVE-2020-17495 django-celery-results through 1.2.1 stores task results in the database. vulnerability
Weakness · CWE (1)
- CWE-312 Cleartext Storage of Sensitive Information weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-17495 advisory
- https://github.com/celery/django-celery-results/issues/142 web
- https://github.com/celery/django-celery-results/issues/154 web
- https://github.com/celery/django-celery-results/pull/316 web
- https://github.com/celery/django-celery-results/commit/ad508fe3433499e5fc94645412d911e174863f28 web
- https://github.com/advisories/GHSA-fvx8-v524-8579 advisory
- https://github.com/celery/django-celery-results package
- https://github.com/pypa/advisory-database/tree/main/vulns/django-celery-results/PYSEC-2020-38.yaml web