—

PYSEC-2020-38

Quick fix

PYSEC-2020-38 — django-celery-results: upgrade to the fixed version with the command below.

pip install --upgrade 'django-celery-results>=2.0.0'

Details

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/django-celery-results

Introduced in: 0Fixed in: 2.0.0

Fixpip install --upgrade 'django-celery-results>=2.0.0'

References

https://github.com/celery/django-celery-results/issues/142[REPORT]
https://github.com/advisories/GHSA-fvx8-v524-8579[ADVISORY]