CVE-2021-23727
2 advisories.
PyPI/celery CVE-2021-23727: high 7.5, EPSS 3.88%
OS Command Injection in celery
Action: Upgrade celery to 5.2.2 or later.
pip install celery==5.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.2.2 | - |
Fixed versions
| 5.2.2 |
Sources
- osv: GHSA-q4xr-rc97-m4xx
- https://nvd.nist.gov/vuln/detail/CVE-2021-23727
- https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b
- https://github.com/advisories/GHSA-q4xr-rc97-m4xx
- https://github.com/celery/celery
- https://github.com/celery/celery/blob/master/Changelog.rst%23522
- https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5
- https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
CVE-2021-23727 · published · modified · JSON
PyPI/celery CVE-2021-23727: unknown, EPSS 3.88%
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized.
Action: Upgrade celery to 5.2.2 or later.
pip install celery==5.2.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 5.2.2 | - |
Fixed versions
| 5.2.2 |
Sources
- osv: PYSEC-2021-858
- https://github.com/celery/celery/blob/master/Changelog.rst%23522
- https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953
- https://github.com/advisories/GHSA-q4xr-rc97-m4xx
CVE-2021-23727 · published · modified · JSON