Safety vulnerability ID: 43738
The information on this page was manually curated by our Cybersecurity Intelligence Team.
Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Latest version: 5.4.0
Distributed Task Queue.
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system. See CVE-2021-23727.
MISC:https://github.com/celery/celery/blob/master/Changelog.rst%23522: https://github.com/celery/celery/blob/master/Changelog.rst%23522
MISC:https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953: https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
Scan your Python project for dependency vulnerabilities in two minutes
Scan your application