Safety CI > cookiecutter/cookiecutter-django

master

4 years, 8 months ago

8e0f65b8

Update Changelog

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

master

4 years, 8 months ago

4cd205b1

Merge pull request #3372 from foarsitter/debian_buster Update docker and non-docker configs to Debi

celery 5.1.2 has known security vulnerabilities.

Package	Installed	Affected	Info
celery	5.1.2	<5.2.0	show Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.
celery	5.1.2	<5.2.2	show Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Package

Installed

Affected

Info

celery

5.1.2

<5.2.0

show

Celery 5.2.0 updates 'kombu' to v5.2.1, which includes dependencies updates that resolve security issues.

celery

5.1.2

<5.2.2

show

Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

pyup-update-celery-5.1.2-to-5.2.0

4 years, 8 months ago