NVD

Id
10817  
Name
CVE-2011-4356  
Description
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2011-12-05  
Modified Date
2012-01-03  
Seq
2011-4356  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
60792 10817 CVE-2011-4356 50825  View
60793 10817 CVE-2011-4356 https://github.com/ask/celery/blob/master/docs/sec/CELERYSA-0001.txt  View
60794 10817 CVE-2011-4356 https://github.com/ask/celery/pull/544  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
32957 JVNDB-2011-003197 Celery における権限を取得される脆弱性 Celery は、celerybeat、celeryd_detach、celeryd-multi、および celeryev での --uid、--gid 引数の処理中に、id を変更するため、権限を取得される脆弱性が存在します。 CVE-2011-4356 52263 CVE-2011-4356 10817 6.9 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-003197.html 2011-12-05 2011-12-12 View