PT-2020-15025 · Django+1 · Django-Celery-Results+1

Published 2020-08-11 · Updated 2021-06-04 · CVE-2020-17495

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions django-celery-results versions prior to 2.4.0 django-celery-results version 1.2.1

Description The issue concerns the storage of task results in the database, which may include sensitive cleartext information passed into tasks as variables. This sensitive information does not belong unencrypted in the database.

Recommendations For django-celery-results versions prior to 2.4.0, consider disabling the storage of task results in the database or ensure that any sensitive variables are properly encrypted before storage. For django-celery-results version 1.2.1, update to a version where the default behavior no longer stores sensitive information unencrypted, such as version 2.4.0 or later, and be cautious with the result extended flag to avoid storing sensitive variables without proper scrubbing.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2020-17495

GHSA-FVX8-V524-8579

PYSEC-2020-38

Affected Products

Debian

Django-Celery-Results

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-17495 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-17495 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-17495 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-17495 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-17495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17495 · Security Note
• https://osv.dev/vulnerability/GHSA-fvx8-v524-8579 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-38 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-17495 · Vendor Advisory
• https://github.com/celery/django-celery-results/issues/142 · Note
• https://github.com/celery/django-celery-results · Note
• https://github.com/celery/django-celery-results/pull/316 · Note
• https://github.com/celery/django-celery-results/commit/ad508fe3433499e5fc94645412d911e174863f28 · Note
• https://github.com/celery/django-celery-results/issues/154 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/django-celery-results/PYSEC-2020-38.yaml · Note