Description
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | celery | 2.4.6-1 | — |
| Debian 13 | celery | 2.4.6-1 | — |
| Debian 12 | celery | 2.4.6-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | celery | >= 2.1.0, < 2.2.8 | 2.2.8 | GHSA-rpc6-h455-3rx5 |
| PyPI | celery | >= 2.3.0, < 2.3.4 | 2.3.4 | GHSA-rpc6-h455-3rx5 |
| PyPI | celery | >= 2.4.0, < 2.4.4 | 2.4.4 | GHSA-rpc6-h455-3rx5 |
| PyPI | celery | >= 2.1, < 2.2.8 · >= 2.3, < 2.3.4 · >= 2.4, < 2.4.4 | 2.2.8, 2.3.4, 2.4.4 | PYSEC-2011-17 |
References
- 46973 third-party-advisory
- 50825 vdb-entry
- https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt
- https://github.com/ask/celery/pull/544