Re: CVE-2011-4356: Affects celery only, not django-celery

[Moritz Mühlenhoff <jmm@inutil.org>]

On Mon, Jan 02, 2012 at 12:46:15PM +0100, Michael Fladischer wrote:
> A happy new year to all of you!
> 
> I'd like to provide some additional information on CVE-2011-4356.
> [0] states that it affects django-celery but this is just an integration
> package between django and celery. The CVE itself would have only
> affected celery (and it's binary package python-celery). Upstream has
> fixed it in 2.4.4 [1] with 2.4.5 currently sitting in unstable and no
> package in testing or older. Right now I'm preparing celery-2.4.6 which
> includes a further fix to this CVE [2].
> I hope this gives you enough information to update the tracker
> accordingly.

Thanks for contacting us.

Michael Gilbert already fixed the django-celery entry. We'll record
2.4.6 as the fixed version once it has been uploaded.

Cheers,
        Moritz