Vulnerability · Published Dec 29, 2021 · Assigned by snyk
CVE-2021-23727Stored Command Injection
High 7.5
In plain English
A high-severity security flaw in celery. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.6% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | celery | 5.2.3-1 | DEBIAN-CVE-2021-23727 |
| Debian:13 | celery | 5.2.3-1 | DEBIAN-CVE-2021-23727 |
| Debian:14 | celery | 5.2.3-1 | DEBIAN-CVE-2021-23727 |
| PyPI | celery | 5.2.2 | GHSA-q4xr-rc97-m4xx |
| PyPI | celery | 5.2.2 | PYSEC-2021-858 |
| Ubuntu:24.04:LTS | celery | no fix listed | UBUNTU-CVE-2021-23727 |
Affected products (as reported)
References
- https://snyk.io/vuln/SNYK-PYTHON-CELERY-2314953 x_refsource_MISC
- https://github.com/celery/celery/blob/master/Changelog.rst%23522 x_refsource_MISC
- FEDORA-2022-1dae017601 vendor-advisory, x_refsource_FEDORA