WS-2016-0135

The default configuration in Celery 4.0.0 allowed for deserialization of pickled messages, even if the software is configured to send messages in the JSON format...

Deserialization Of Pickled Message

Celery is vulnerable to deserialization attacks. The default configuration in Celery allows for the deserialization of pickled messages, even if it is configured to send messages in the JSON format. This is because the acceptcontent setting by default is set to: app.conf.acceptcontent = 'json',...