PT-2011-4940 · Celery · Celery

Ask Solem · Publicado 2011-12-05 · Atualizado 2022-05-17 · CVE-2011-4356

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Celery versions 2.1 through 2.2.7 Celery versions 2.3 through 2.3.3 Celery versions 2.4 through 2.4.3

Description The issue allows local users to gain privileges via vectors involving crafted code that is executed by the worker process. This is due to the software changing the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd detach, celeryd-multi, and celeryev.

Recommendations For Celery versions 2.1 through 2.2.7, update to version 2.2.8 or later. For Celery versions 2.3 through 2.3.3, update to version 2.3.4 or later. For Celery versions 2.4 through 2.4.3, update to version 2.4.4 or later.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

CWE-264

Identificadores relacionados

CVE-2011-4356

GHSA-RPC6-H455-3RX5

PYSEC-2011-17

Produtos afetados

Celery

Referências · 19

• https://github.com/celery/celery/blob/master/docs/sec/CELERYSA-0001.txt · Nota
• https://github.com/celery/celery/commit/53514b158b743678d8993638be5920cd09ccc35c · Nota
• https://github.com/celery/celery/pull/544 · Nota
• https://github.com/celery/celery/commit/73388921731a0e6feb28ab0d389c4f7dc4d524f6 · Nota
• https://github.com/celery/celery/commit/e0767e40994754fe8482bf4ff622c5c6d0b9f671 · Nota
• https://github.com/celery/celery · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/celery/PYSEC-2011-17.yaml · Nota
• https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt · Correção
• https://github.com/ask/celery/pull/544 · Nota
• https://web.archive.org/web/20140722114447/http://secunia.com/advisories/46973 · Nota
• http://secunia.com/advisories/46973 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4356 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2011-4356 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2011-17 · Aviso do Fabricante
• http://securityfocus.com/bid/50825 · Nota