[Snyk: Medium] Celery - Stored Command Injection (03/29/2022)

[pkfec]

Overview:

Affected versions of this package are vulnerable to Stored Command Injection. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.

https://security.snyk.io/vuln/SNYK-PYTHON-CELERY-2314953

Possibly related issue: #3607

Detailed paths:

Introduced through: project@0.0.0 › celery@4.3.0
Fix: Upgrade celery to version 5.2.2

Introduced through: project@0.0.0 › celery-once@3.0.0 › celery@4.3.0
Fix: Pin celery to version 5.2.2

Remediation:

Upgrade celery to version 5.2.2 or higher.

Completion criteria:

• Upgrade celery to version 5.2.2 or higher.
• Run all celery task to make scheduled tasks work OK after the upgrade