Updates Changelog

Changelog

@@ -12,9 +12,25 @@ an overview of what's new in Celery 4.0.
 
 4.0.1
 =====
-:release-date: TBA
+:release-date: 2016-12-08 05:22 PM PST
 :release-by: Ask Solem
 
+* [Security: `CELERYSA-0003`_] Insecure default configuration
+
+    The default :setting:`accept_content` setting was set to allow
+    deserialization of pickled messages in Celery 4.0.0.
+
+    The insecure default has been fixed in 4.0.1, and you can also
+    configure the 4.0.0 version to explicitly only allow json serialized
+    messages:
+
+    .. code-block:: python
+
+        app.conf.accept_content = ['json']
+
+.. _`CELERYSA-0003`:
+    https://github.com/celery/celery/tree/master/docs/sec/CELERYSA-0003.txt
+
 - **Tasks**: Added new method to register class-based tasks (Issue #3615).
 
     To register a class based task you should now call ``app.register_task``:
@@ -32,6 +48,11 @@ an overview of what's new in Celery 4.0.
 
         app.register_task(CustomTask())
 
+- **Tasks**: Argument checking now supports keyword-only arguments on Python3
+  (Issue #3658).
+
+    Contributed by :github_user:`sww`.
+
 - **Tasks**: The ``task-sent`` event was not being sent even if
   configured to do so (Issue #3646).
 

docs/sec/CELERYSA-0003.txt

@@ -0,0 +1,59 @@
+=========================================
+ CELERYSA-0003: Celery Security Advisory
+=========================================
+:contact: security@celeryproject.org
+:CVE id: TBA
+:date: 2016-12-08 05:00:00 p.m. PST
+
+Details
+=======
+
+:package: celery
+:vulnerability: Configuration Error
+:problem type: remote
+:risk: low
+:versions-affected: 4.0.0
+
+Description
+===========
+
+The default configuration in Celery 4.0.0 allowed for deserialization
+of pickled messages, even if the software is configured to send
+messages in the JSON format.
+
+The particular configuration in question is the `accept_content` setting,
+which by default was set to:
+
+    app.conf.accept_content = ['json', 'pickle', 'msgpack', 'yaml']
+
+The risk is still set to low considering that an attacker would require access
+to the message broker used to send messages to Celery workers.
+
+Systems affected
+================
+
+Users of Celery version 4.0.0 with no explicit accept_content setting set.
+
+Solution
+========
+
+To work around the issue you can explicitly configure the accept_content
+setting:
+
+    app.conf.accept_content = ['json']
+
+Or you can upgrade to the Celery 4.0.1 version:
+
+    $ pip install -U celery
+
+Distribution package maintainers are urged to provide their users
+with updated packages.
+
+Please direct questions to the celery-users mailing-list:
+http://groups.google.com/group/celery-users/,
+
+or if you're planning to report a new security related issue we request that
+you keep the information confidential by contacting
+security@celeryproject.org instead.
+
+Thank you!