CVE-2020-17495 django-celery-results Stores Sensitive Information In Cleartext
Attackers with database access can read sensitive cleartext task variables stored by django-celery-results, exposing confidential data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17495?
CVE-2020-17495 is a high-severity vulnerability in n/a, published on 11 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.
Weakness: CWE-312
Which versions are affected by CVE-2020-17495?
3 open source packages ship an affected version, including django-celery-results. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
django-celery-results PyPI | All versions | 2.0.0 |
django-celery-results PyPI | All versions | 2.4.0 |
django-celery-results PyPI | All versions | 2.4.0 |
Products include Django-Celery-Results Project Django-Celery-Results.
How do I fix CVE-2020-17495?
Upgrade django-celery-results to a fixed version for your release line: 2.0.0 or 2.4.0.
Is CVE-2020-17495 being exploited?
There is no known exploitation of CVE-2020-17495 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2020-17495, GHSA-fvx8-v524-8579, PYSEC-2020-38, UBUNTU-CVE-2020-17495.