CVE-2011-4356

Опубликовано: 05 дек. 2011

Источник: nvd

CVSS2: 6.9

EPSS Низкий

Описание

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:celeryproject:celery:2.1.0:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.0:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.1:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.2:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.3:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.4:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.5:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.6:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.2.7:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.3.0:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.3.1:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.3.2:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.3.3:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.4.0:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.4.1:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.4.2:*:*:*:*:*:*:*

cpe:2.3:a:celeryproject:celery:2.4.3:*:*:*:*:*:*:*

EPSS

Процентиль: 15%

0.00047

Низкий

6.9 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

CVE-2011-4356

debian

около 14 лет назад

Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4. ...

GHSA-rpc6-h455-3rx5

github

больше 3 лет назад

Celery local privilege escalation vulnerability