Celeryproject Celery vulnerabilities
2 known vulnerabilities affecting celeryproject/celery.
Total CVEs
2
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM1
Vulnerabilities
Page 1 of 1
CVE-2021-23727P3HIGHCVSS 7.5fixed in 5.2.2≥ unspecified, < 5.2.22021-12-29
CVE-2021-23727 [HIGH] CWE-77 CVE-2021-23727: This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulner
ghsanvdosv
CVE-2011-4356P4MEDIUMCVSS 6.9v2.1.0v2.2.0+15 more2011-12-05
CVE-2011-4356 [MEDIUM] CWE-264 CVE-2011-4356: Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
ghsanvdosv