Every CVE Search/ Get API key

CVE-2020-17495

django-celery-results Stores Sensitive Information In Cleartext

7.5 HighFix available

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.87%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
CVE-2020-17495
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-312
Updated
2026-11-02
CVE List No score

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
CVE-2020-17495
Updated
2026-11-02
EUVDEUVD-2020-0063 No score

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
EUVD-2020-0063
Updated
2026-11-03
GitHub AdvisoriesGHSA-fvx8-v524-8579 8.7

django-celery-results Stores Sensitive Information In Cleartext

django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

In version 2.4.0 this is no longer the default behaviour but can be re-enabled with the result_extended flag in which case care should be taken to ensure any sensitive variables are scrubbed - see here for an example.

Record
GHSA-fvx8-v524-8579
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312
Updated
2026-11-02
OSV 7.5

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
CVE-2020-17495
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-17495 7.5

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
DEBIAN-CVE-2020-17495
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-fvx8-v524-8579 8.7

django-celery-results Stores Sensitive Information In Cleartext

django-celery-results prior to 2.4.0 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

In version 2.4.0 this is no longer the default behaviour but can be re-enabled with the result_extended flag in which case care should be taken to ensure any sensitive variables are scrubbed - see here for an example.

Record
GHSA-fvx8-v524-8579
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-312
Updated
2026-11-02
OSVUBUNTU-CVE-2020-17495 7.5

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
UBUNTU-CVE-2020-17495
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2020-38 No score

django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database.

Record
PYSEC-2020-38
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
django-celery-results
PyPI
before 2.4.0
2.4.0
python-django-celery-results
Debian:12
All versions, plus listed versions
2.4.0-32.5.1-12.5.1-22.5.1-2.12.5.1-32.6.0-12.6.0-2
None known
python-django-celery-results
Debian:13
All versions, plus listed versions
2.5.1-32.6.0-12.6.0-2
None known
python-django-celery-results
Debian:14
All versions, plus listed versions
2.5.1-32.6.0-12.6.0-2
None known
django-celery-results
PyPI
before 2.4.0, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 11 moreShow less
1.1.01.1.11.1.21.2.01.2.12.0.02.0.12.1.02.2.02.3.02.3.1
2.4.0
django-celery-results
PyPI
before 2.0.0, plus listed versions
1.0.01.0.11.0.21.0.31.0.4
Show 5 moreShow less
1.1.01.1.11.1.21.2.01.2.1
2.0.0
python-django-celery-results
Ubuntu:18.04:LTS
All versions, plus listed versions
1.0.1-1
None known
python-django-celery-results
Ubuntu:20.04:LTS
All versions, plus listed versions
1.0.4-1
None known
python-django-celery-results
Ubuntu:22.04:LTS
All versions, plus listed versions
2.0.0-1
None known
python-django-celery-results
Ubuntu:24.04:LTS
All versions, plus listed versions
2.5.1-1ubuntu1
None known
python-django-celery-results
Ubuntu:25.10
All versions, plus listed versions
2.5.1-3
None known
python-django-celery-results
Ubuntu:26.10
All versions, plus listed versions
2.6.0-12.6.0-2
None known
python-django-celery-results
Ubuntu:26.04:LTS
All versions, plus listed versions
2.5.1-32.6.0-1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-17495 is a high vulnerability (CVSS 7.5) in Django-celery-results Project Django-celery-results, published August 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 59th percentile. Fixed in django-celery-results 2.4.0.

References

Show 5 moreShow less
MoveEnter Open