GitHub Advisoryadvisory · PyPI
GHSA-q4xr-rc97-m4xx OS Command Injection in celery
HIGH
Official page ↗
- Aliases
- CVE-2021-23727
- Ecosystem
- PyPI
- Packages
- celery
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-77, CWE-78
- Reviewed
- 2022-01-06
Affected packages
• PyPI celery: < 5.2.2 → fixed in 5.2.2
Description
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Related
Alias · CVE (1)
- CVE-2021-23727 This affects the package celery before 5.2.2. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-23727 advisory
- https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b web
- https://github.com/advisories/GHSA-q4xr-rc97-m4xx advisory
- https://github.com/celery/celery package
- https://github.com/celery/celery/blob/master/Changelog.rst%23522 web
- https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml web
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5 web
- https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953 web