[Python-modules-team] Bug#968305: python-django-celery-results: CVE-2020-17495

[Salvatore Bonaccorso]

Source: python-django-celery-results
Version: 1.0.4-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/celery/django-celery-results/issues/142
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for python-django-celery-results.

CVE-2020-17495[0]:
| django-celery-results through 1.2.1 stores task results in the
| database. Among the data it stores are the variables passed into the
| tasks. The variables may contain sensitive cleartext information that
| does not belong unencrypted in the database.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-17495
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-17495
[1] https://github.com/celery/django-celery-results/issues/142

Regards,
Salvatore