Vulnerability-Lookup

PYSEC-2021-858

Vulnerability from pysec - Published: 2021-12-29 17:15 - Updated: 2021-12-29 19:23

Details

This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

Impacted products

Name	purl
celery	pkg:pypi/celery

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "celery",
        "purl": "pkg:pypi/celery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.10",
        "0.1.11",
        "0.1.12",
        "0.1.13",
        "0.1.14",
        "0.1.15",
        "0.1.2",
        "0.1.4",
        "0.1.6",
        "0.1.7",
        "0.1.8",
        "0.2.0",
        "0.3.0",
        "0.3.20",
        "0.3.7",
        "0.4.0",
        "0.4.1",
        "0.6.0",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.8.3",
        "0.8.4",
        "1.0.0",
        "1.0.1",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "2.0.0",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.1.0",
        "2.1.1",
        "2.1.2",
        "2.1.3",
        "2.1.4",
        "2.2.0",
        "2.2.1",
        "2.2.10",
        "2.2.2",
        "2.2.3",
        "2.2.4",
        "2.2.5",
        "2.2.6",
        "2.2.7",
        "2.2.8",
        "2.2.9",
        "2.3.0",
        "2.3.1",
        "2.3.2",
        "2.3.3",
        "2.3.4",
        "2.3.5",
        "2.4.0",
        "2.4.1",
        "2.4.2",
        "2.4.3",
        "2.4.4",
        "2.4.5",
        "2.4.6",
        "2.4.7",
        "2.5.0",
        "2.5.1",
        "2.5.2",
        "2.5.3",
        "2.5.5",
        "3.0.0",
        "3.0.1",
        "3.0.10",
        "3.0.11",
        "3.0.12",
        "3.0.13",
        "3.0.14",
        "3.0.15",
        "3.0.16",
        "3.0.17",
        "3.0.18",
        "3.0.19",
        "3.0.2",
        "3.0.20",
        "3.0.21",
        "3.0.22",
        "3.0.23",
        "3.0.24",
        "3.0.25",
        "3.0.3",
        "3.0.4",
        "3.0.5",
        "3.0.6",
        "3.0.7",
        "3.0.8",
        "3.0.9",
        "3.1.0",
        "3.1.1",
        "3.1.10",
        "3.1.11",
        "3.1.12",
        "3.1.13",
        "3.1.14",
        "3.1.15",
        "3.1.16",
        "3.1.17",
        "3.1.18",
        "3.1.19",
        "3.1.2",
        "3.1.20",
        "3.1.21",
        "3.1.22",
        "3.1.23",
        "3.1.24",
        "3.1.25",
        "3.1.26-1",
        "3.1.26.post2",
        "3.1.3",
        "3.1.4",
        "3.1.5",
        "3.1.6",
        "3.1.7",
        "3.1.8",
        "3.1.9",
        "4.0.0",
        "4.0.0rc3",
        "4.0.0rc4",
        "4.0.0rc5",
        "4.0.0rc6",
        "4.0.0rc7",
        "4.0.1",
        "4.0.2",
        "4.1.0",
        "4.1.1",
        "4.2.0",
        "4.2.0rc1",
        "4.2.0rc2",
        "4.2.0rc3",
        "4.2.0rc4",
        "4.2.1",
        "4.2.2",
        "4.3.0",
        "4.3.0rc1",
        "4.3.0rc2",
        "4.3.0rc3",
        "4.3.1",
        "4.4.0",
        "4.4.0rc1",
        "4.4.0rc2",
        "4.4.0rc3",
        "4.4.0rc4",
        "4.4.0rc5",
        "4.4.1",
        "4.4.2",
        "4.4.3",
        "4.4.4",
        "4.4.5",
        "4.4.6",
        "4.4.7",
        "5.0.0",
        "5.0.0a1",
        "5.0.0a2",
        "5.0.0b1",
        "5.0.0rc1",
        "5.0.0rc2",
        "5.0.0rc3",
        "5.0.1",
        "5.0.2",
        "5.0.3",
        "5.0.4",
        "5.0.5",
        "5.0.6",
        "5.1.0",
        "5.1.0b1",
        "5.1.0b2",
        "5.1.0rc1",
        "5.1.1",
        "5.1.2",
        "5.2.0",
        "5.2.0b1",
        "5.2.0b2",
        "5.2.0b3",
        "5.2.0rc1",
        "5.2.0rc2",
        "5.2.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23727",
    "SNYK-PYTHON-CELERY-2314953",
    "GHSA-q4xr-rc97-m4xx"
  ],
  "details": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.",
  "id": "PYSEC-2021-858",
  "modified": "2021-12-29T19:23:51.138646Z",
  "published": "2021-12-29T17:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
    },
    {
      "type": "ADVISORY",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q4xr-rc97-m4xx"
    }
  ]
}

CVE-2021-23727 (GCVE-0-2021-23727)

Vulnerability from cvelistv5 – Published: 2021-12-29 16:35 – Updated: 2024-09-16 20:53

Title

Stored Command Injection

Summary

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

CWE

Stored Command Injection

Assigner

snyk

References

URL

Tags

	https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953	x_refsource_MISC
	https://github.com/celery/celery/blob/master/Chan…	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	n/a	celery	Affected: unspecified , < 5.2.2 (custom)

Date Public ?

2021-12-29 00:00

Credits

Calum Hutton from Snyk Research Team

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T19:14:08.701Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
          },
          {
            "name": "FEDORA-2022-1dae017601",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "celery",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "5.2.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Calum Hutton from Snyk Research Team"
        }
      ],
      "datePublic": "2021-12-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.7,
            "temporalSeverity": "MEDIUM",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Stored Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-01-16T03:06:38.000Z",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
        },
        {
          "name": "FEDORA-2022-1dae017601",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
        }
      ],
      "title": "Stored Command Injection",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2021-12-29T16:34:07.450278Z",
          "ID": "CVE-2021-23727",
          "STATE": "PUBLIC",
          "TITLE": "Stored Command Injection"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "celery",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "5.2.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Calum Hutton from Snyk Research Team"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Stored Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
            },
            {
              "name": "https://github.com/celery/celery/blob/master/Changelog.rst%23522",
              "refsource": "MISC",
              "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
            },
            {
              "name": "FEDORA-2022-1dae017601",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2021-23727",
    "datePublished": "2021-12-29T16:35:11.896Z",
    "dateReserved": "2021-01-08T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:53:22.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-Q4XR-RC97-M4XX

Vulnerability from github – Published: 2022-01-06 22:22 – Updated: 2024-09-06 16:27

Summary

OS Command Injection in celery

Details

Severity ?

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

7.7 (High)


                  
                    CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "celery"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-23727"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-01-06T19:17:52Z",
    "nvd_published_at": "2021-12-29T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.",
  "id": "GHSA-q4xr-rc97-m4xx",
  "modified": "2024-09-06T16:27:25Z",
  "published": "2022-01-06T22:22:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23727"
    },
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/commit/1f7ad7e6df1e02039b6ab9eec617d283598cad6b"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-q4xr-rc97-m4xx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/celery/celery"
    },
    {
      "type": "WEB",
      "url": "https://github.com/celery/celery/blob/master/Changelog.rst%23522"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2021-858.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SYXRGHWHD2WWMHBWCVD5ULVINPKNY3P5"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OS Command Injection in celery"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

PYSEC-2021-858

CVE-2021-23727 (GCVE-0-2021-23727)

GHSA-Q4XR-RC97-M4XX

Tags

Sightings

Nomenclature