CVE-2020-17495: django-celery-results - Cleartext Storage of Sensitive Information
Summary
CVE-2020-17495: django-celery-results Stores Sensitive Information In Cleartext. Affects django-celery-results versions < 2.4.0. Fixed in 2.4.0. How to fix ↓
Also tracked for
- python-django-celery-results · Debian:11
The same CVE-2020-17495 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
django-celery-results is a package that stores task results in the database. It is commonly used in Django applications to manage and track asynchronous tasks. However, prior to version 2.4.0, it had a vulnerability that allowed sensitive cleartext information to be stored in the database. This information includes variables passed into the tasks, which may contain sensitive data that should not be stored unencrypted. The default behavior was changed in version 2.4.0, but it can still be re-enabled with the result_extended flag, requiring caution to ensure sensitive variables are properly handled.
Vulnerability Detail
The vulnerability in django-celery-results (CVE-2020-17495) arises from the storage of sensitive cleartext information in the database. This information includes variables passed into tasks, which may contain confidential data. Storing such data unencrypted poses a risk of unauthorized access and potential data breaches. The vulnerability was addressed in version 2.4.0, where the default behavior was changed. However, if the result_extended flag is used, care must be taken to scrub any sensitive variables to prevent exposure.
How To Fix
Minimum fixed version
2.4.0
This is the first release that contains the fix.
pip install --upgrade "django-celery-results==2.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to version 2.4.0 is not immediately feasible, a workaround is to avoid using the result_extended flag. By not enabling this flag, the storage of sensitive cleartext information in the database can be prevented. However, this workaround may limit the functionality of the package.
Conclusion
In conclusion, the vulnerability (CVE-2020-17495) in django-celery-results allows sensitive cleartext information to be stored in the database. Upgrading to version 2.4.0 or later and properly handling sensitive variables can mitigate this issue. If immediate upgrade is not possible, avoiding the result_extended flag can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django-celery-results →
FAQ
django-celery-results is a package used in Django applications to store and manage task results in the database.
The vulnerability allows sensitive cleartext information to be stored in the database, which can lead to unauthorized access and potential data breaches.
To fix the vulnerability, upgrade django-celery-results to version 2.4.0 or later and ensure sensitive variables are properly handled if the result_extended flag is used.
Yes, you can avoid using the result_extended flag to prevent the storage of sensitive cleartext information in the database. However, this may limit the functionality of the package.
You can find more information about this vulnerability in the GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/06/GHSA-fvx8-v524-8579/GHSA-fvx8-v524-8579.json
