Sensitive Information Exposure in django-celery-results
Summary
CVE-2020-17495: django-celery-results through 1.2.1 stores task results in the database. Affects python-django-celery-results versions < 890a9632bb548248ff4d3d3ace47e2f31dc3e1c7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-celery-results is a package that stores task results in the database. It is commonly used in Django applications to manage and track the results of asynchronous tasks. The package allows variables passed into the tasks to be stored in the database, including sensitive information. However, in versions up to 1.2.1, this sensitive information is stored in cleartext, which poses a security risk.
Vulnerability Detail
The vulnerability (CVE-2020-17495) in django-celery-results allows sensitive cleartext information to be stored in the database. This information may include credentials, API keys, or other sensitive data that should be encrypted. An attacker with access to the database can potentially retrieve this information and misuse it. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to upgrade to a patched version as mentioned in the 'how_to_fix' section.
Conclusion
In conclusion, the vulnerability in django-celery-results allows sensitive information to be stored in cleartext in the database. Upgrading to version 1.2.2 or higher is recommended to fix this issue. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for python-django-celery-results →
FAQ
django-celery-results is a package used in Django applications to store and manage task results in the database.
The vulnerability allows sensitive information to be stored in cleartext in the database, which can be accessed by attackers. This can lead to unauthorized access and misuse of the exposed information.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
Yes, upgrading to django-celery-results version 1.2.2 or higher fixes this vulnerability. The maintainers have addressed the issue and ensured that sensitive information is properly encrypted in the database.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-django-celery-results.
