~ / search / GHSA-q4qm-xhf9-4p8f

GHSA-q4qm-xhf9-4p8f

Flower OAuth authentication bypass

Source: GitHub Advisory Database (reviewed) High CVE-2022-30034

Packages

EcosystemPackageAffectedFixed in
PyPI flower < 1.2.0 1.2.0

Details

As written in the advisory (Markdown source, shown as plain text).

All versions of Flower, a web UI for the Celery Python RPC framework, as of 05-02-2022 are vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. A fix was released in version 1.2.0.

References

External links from the advisory. They lead to third-party sites.