GHSA-fvx8-v524-8579
django-celery-results Stores Sensitive Information In Cleartext
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | django-celery-results | < 2.4.0 | 2.4.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
In version 2.4.0 this is no longer the default behaviour but can be re-enabled with the `result_extended` flag in which case care should be taken to ensure any sensitive variables are scrubbed - see [here](https://github.com/celery/django-celery-results/issues/154#issuecomment-734706270) for an example.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-17495
- https://github.com/celery/django-celery-results/issues/142
- https://github.com/celery/django-celery-results/issues/154
- https://github.com/celery/django-celery-results/pull/316
- https://github.com/celery/django-celery-results/commit/ad508fe3433499e5fc94645412d911e174863f28
- https://github.com/advisories/GHSA-fvx8-v524-8579
- https://github.com/celery/django-celery-results
- https://github.com/pypa/advisory-database/tree/main/vulns/django-celery-results/PYSEC-2020-38.yaml