-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| celery | pip | >= 2.1.0, < 2.2.8 | 2.2.8 |
| celery | pip | >= 2.3.0, < 2.3.4 | 2.3.4 |
| celery | pip | >= 2.4.0, < 2.4.4 | 2.4.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from Celery changing the effective UID/GID but not the real UID/GID when processing --uid/--gid arguments. The provided commit diff shows the run function in celery/apps/worker.py incorrectly used os.geteuid() to check for root privileges, which is a symptom of the broader issue. While the exact functions modifying UID/GID (e.g., via setuid/seteuid) are not explicitly shown in the provided diffs, the run function's incorrect check reflects the underlying privilege management flaw. The advisory and CWE-269 confirm the root cause is improper handling of real vs. effective IDs, making the run function's logic a key indicator of the vulnerability.
PythonPython