github - GHSA-q4xr-rc97-m4xx

GHSA-q4xr-rc97-m4xx

Vulnerability from github

Published

2022-01-06 22:22

Modified

2024-09-06 16:27

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
7.7 (High) - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

OS Command Injection in celery

Details

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "celery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T19:17:52Z",
    "nvd_published_at": "2021-12-29T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.",
  "id": "GHSA-q4xr-rc97-m4xx",
  "modified": "2024-09-06T16:27:25Z",
  "published": "2022-01-06T22:22:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q4xr-rc97-m4xx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/celery/celery"
    },
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OS Command Injection in celery"
}

pysec-2021-858

Vulnerability from pysec

Published

2021-12-29 17:15

Modified

2021-12-29 19:23

Details

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "celery",
        "purl": "pkg:pypi/celery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.2",
        "0.1.4",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.2.0",
        "0.3.0",
        "0.3.20",
        "0.3.7",
        "0.4.0",
        "0.4.1",
        "0.6.0",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.2.0",
        "2.2.1",
        "2.2.10",
        "2.2.2",
        "2.2.3",
        "2.2.4",
        "2.2.5",
        "2.2.6",
        "2.2.7",
        "2.2.8",
        "2.2.9",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5",
        "2.4.6",
        "2.4.7",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.5.5",
        "3.0.0",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.12",
        "3.0.13",
        "3.0.14",
        "3.0.15",
        "3.0.16",
        "3.0.17",
        "3.0.18",
        "3.0.19",
        "3.0.2",
        "3.0.20",
        "3.0.21",
        "3.0.22",
        "3.0.23",
        "3.0.24",
        "3.0.25",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.1",
        "3.1.10",
        "3.1.11",
        "3.1.12",
        "3.1.13",
        "3.1.14",
        "3.1.15",
        "3.1.16",
        "3.1.17",
        "3.1.18",
        "3.1.19",
        "3.1.2",
        "3.1.20",
        "3.1.21",
        "3.1.22",
        "3.1.23",
        "3.1.24",
        "3.1.25",
        "3.1.26-1",
        "3.1.26.post2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.1.8",
        "3.1.9",
        "4.0.0",
        "4.0.0rc3",
        "4.0.0rc4",
        "4.0.0rc5",
        "4.0.0rc6",
        "4.0.0rc7",
        "4.0.1",
        "4.0.2",
        "4.1.0",
        "4.1.1",
        "4.2.0",
        "4.2.0rc1",
        "4.2.0rc2",
        "4.2.0rc3",
        "4.2.0rc4",
        "4.2.1",
        "4.2.2",
        "4.3.0",
        "4.3.0rc1",
        "4.3.0rc2",
        "4.3.0rc3",
        "4.3.1",
        "4.4.0",
        "4.4.0rc1",
        "4.4.0rc2",
        "4.4.0rc3",
        "4.4.0rc4",
        "4.4.0rc5",
        "4.4.1",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "4.4.6",
        "4.4.7",
        "5.0.0",
        "5.0.0a1",
        "5.0.0a2",
        "5.0.0b1",
        "5.0.0rc1",
        "5.0.0rc2",
        "5.0.0rc3",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0.6",
        "5.1.0",
        "5.1.0b1",
        "5.1.0b2",
        "5.1.0rc1",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.0b1",
        "5.2.0b2",
        "5.2.0b3",
        "5.2.0rc1",
        "5.2.0rc2",
        "5.2.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23727",
    "SNYK-PYTHON-CELERY-2314953",
    "GHSA-q4xr-rc97-m4xx"
  ],
  "details": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.",
  "id": "PYSEC-2021-858",
  "modified": "2021-12-29T19:23:51.138646Z",
  "published": "2021-12-29T17:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
    },
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q4xr-rc97-m4xx"
    }
  ]
}

cve-2021-23727

Vulnerability from cvelistv5

Published

2021-12-29 16:35

Modified

2024-09-16 20:53

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Summary

References

▼	URL	Tags
	https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953	x_refsource_MISC
	https://github.com/celery/celery/blob/master/Changelog.rst%23522	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/	vendor-advisory, x_refsource_FEDORA

Impacted products

Vendor

Product

Version

▼

n/a

celery

Version: unspecified < 5.2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:08.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
          },
          {
            "name": "FEDORA-2022-1dae017601",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "celery",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.2.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Calum Hutton from Snyk Research Team"
        }
      ],
      "datePublic": "2021-12-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stored Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-16T03:06:38",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
        },
        {
          "name": "FEDORA-2022-1dae017601",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
        }
      ],
      "title": "Stored Command Injection",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-12-29T16:34:07.450278Z",
          "ID": "CVE-2021-23727",
          "STATE": "PUBLIC",
          "TITLE": "Stored Command Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "celery",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Calum Hutton from Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stored Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
            },
            {
              "name": "https://github.com/celery/celery/blob/master/Changelog.rst%23522",
              "refsource": "MISC",
              "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
            },
            {
              "name": "FEDORA-2022-1dae017601",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23727",
    "datePublished": "2021-12-29T16:35:11.896554Z",
    "dateReserved": "2021-01-08T00:00:00",
    "dateUpdated": "2024-09-16T20:53:22.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

GHSA-q4xr-rc97-m4xx

Vulnerability from github

pysec-2021-858

Vulnerability from pysec

cve-2021-23727

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature