id: PYSEC-2020-38
details: django-celery-results through 1.2.1 stores task results in the database.
  Among the data it stores are the variables passed into the tasks. The variables
  may contain sensitive cleartext information that does not belong unencrypted in
  the database.
affected:
- package:
    name: django-celery-results
    ecosystem: PyPI
    purl: pkg:pypi/django-celery-results
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: '0'
    - fixed: 2.0.0
  versions:
  - 1.0.0
  - 1.0.1
  - 1.0.2
  - 1.0.3
  - 1.0.4
  - 1.1.0
  - 1.1.1
  - 1.1.2
  - 1.2.0
  - 1.2.1
references:
- type: REPORT
  url: https://github.com/celery/django-celery-results/issues/142
- type: ADVISORY
  url: https://github.com/advisories/GHSA-fvx8-v524-8579
aliases:
- CVE-2020-17495
- GHSA-fvx8-v524-8579
modified: '2020-08-14T20:09:00Z'
published: '2020-08-11T21:15:00Z'