Celery Argument Processing Local Privilege Escalation Vulnerability

Bugtraq ID:	50825
Class:	Design Error
CVE:	CVE-2011-4356
Remote:	No
Local:	Yes
Published:	Nov 28 2011 12:00AM
Updated:	Apr 13 2015 09:53PM
Credit:	Reported by the vendor.
Vulnerable:	GitHub Inc. celery 2.4.3
Not Vulnerable:	GitHub Inc. celery 2.4.4

Celery Argument Processing Local Privilege Escalation Vulnerability

Celery is prone to a local privilege-escalation vulnerability.

Local attackers can exploit this issue to send messages or execute arbitrary code with elevated privileges.

Celery versions prior to 2.4.4 are vulnerable.

Celery Argument Processing Local Privilege Escalation Vulnerability

Attackers require local interactive access to exploit.

Celery Argument Processing Local Privilege Escalation Vulnerability

Solution:
Updates are available. Please see the references for more information.

Celery Argument Processing Local Privilege Escalation Vulnerability

References:

• Add '--use-real-ids' option to change real uid and gid instead of effective (github)
  
• celery - Distributed Task Queue Homepage (github)
  
• celery/docs/sec/CELERYSA-0001.txt (github)