PYSEC-2011-17

vendorUSosv

Advisory ansehen veröffentlicht 2011-12-05Lizenz: CC-BY-4.0

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.

beschreibt (1)

Zugehörige CVEs.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2011-4356US	medium6.9	0.33% (26th)	—	2011-12-05
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybea…

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

http://secunia.com/advisories/46973ADVISORY
http://www.securityfocus.com/bid/50825WEB
https://github.com/advisories/GHSA-rpc6-h455-3rx5ADVISORY
https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txtWEB
https://github.com/ask/celery/pull/544WEB

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan