CVE-2022-30034: High severity Flower Project Flower vulnerability
All versions of Flower, a web UI for the Celery Python RPC framework, as of 05-02-2022 are vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes. A fix was released in version 1.2.0.
Other sources
Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then access the Flower API to discover and invoke arbitrary Celery RPC calls or deny service by shutting down Celery task nodes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/flowerto a version that resolves this vulnerability.Fixed in 1.2.0 - Upgrade
Upgrade
Flower (web UI for Celery Python RPC framework)to a version that resolves this vulnerability.Fixed in 1.2.0
Event History
Frequently Asked Questions
What is the severity of CVE-2022-30034?
CVE-2022-30034 is considered a critical vulnerability due to its potential to allow attackers to bypass authentication and access sensitive functionalities.
How do I fix CVE-2022-30034?
To fix CVE-2022-30034, upgrade Flower to version 1.2.0 or later.
What are the consequences of exploiting CVE-2022-30034?
Exploiting CVE-2022-30034 can lead to unauthorized access to the Flower API, allowing attackers to invoke arbitrary Celery RPC calls or disrupt service by shutting down task nodes.
Which versions of Flower are affected by CVE-2022-30034?
All versions of Flower prior to 1.2.0 are affected by CVE-2022-30034.
Is there a workaround for CVE-2022-30034?
There are no specific workarounds for CVE-2022-30034; upgrading to a patched version is recommended.