Race Condition Affecting django-background-tasks package, versions [,1.1.6)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Race Condition vulnerabilities in an interactive lesson.

Start learning

Snyk IDSNYK-PYTHON-DJANGOBACKGROUNDTASKS-7856168
published2 Sept 2024
disclosed1 Sept 2024
creditUnknown

Report a new vulnerability Found a mistake?

Introduced: 1 Sep 2024

CWE-362 (opens in a new tab)

How to fix?

Upgrade django-background-tasks to version 1.1.6 or higher.

Overview

django-background-tasks is a Database backed asynchronous task queue

Affected versions of this package are vulnerable to Race Condition in the database during multi-threading due to assigning individual database connections to each thread.

References

CVSS Scores

version 4.0

version 3.1

Attack Vector (AV)
Network
Attack Complexity (AC)
High
Attack Requirements (AT)
None
Privileges Required (PR)
None
User Interaction (UI)
None

Confidentiality (VC)
Low
Integrity (VI)
None
Availability (VA)
High

Confidentiality (SC)
None
Integrity (SI)
None
Availability (SA)
None