← Back to CVEs
CVE-2021-23727
HIGH7.5
Description
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
CVE Details
CVSS v3.1 Score7.5
SeverityHIGH
CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorNETWORK
ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
Published12/29/2021
Last Modified11/21/2024
Sourcenvd
Honeypot Sightings0
Affected Products
celeryproject:celeryfedoraproject:extra_packages_for_enterprise_linuxfedoraproject:fedora
Weaknesses (CWE)
CWE-77
References
https://github.com/celery/celery/blob/master/Changelog.rst%23522(report@snyk.io)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/(report@snyk.io)
https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953(report@snyk.io)
https://github.com/celery/celery/blob/master/Changelog.rst%23522(af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/(af854a3a-2127-422b-91ae-364da2661108)
https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953(af854a3a-2127-422b-91ae-364da2661108)
IOC Correlations
No correlations recorded
This product uses data from the NVD API but is not endorsed or certified by the NVD.