kritisch
CVE-2021-42343
An issue was discovered in the Dask distributed package before 2021.10 ...
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD, GHSA. Niedriger laut Ubuntu (mittel).
Beschreibung
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | distributed | 2021.10.0 |
| alpine 3.16 | py3-dask | 2022.2.0-r0 |
| alpine 3.17 | py3-dask | 2022.2.0-r0 |
| alpine 3.18 | py3-dask | 2022.2.0-r0 |
| alpine 3.19 | py3-dask | 2022.2.0-r0 |
| alpine 3.20 | py3-dask | 2022.2.0-r0 |
| alpine 3.21 | py3-dask | 2022.2.0-r0 |
| alpine 3.22 | py3-dask | 2022.2.0-r0 |
| alpine 3.23 | py3-dask | 2022.2.0-r0 |
| alpine 3.24 | py3-dask | 2022.2.0-r0 |
| alpine edge | py3-dask | 2022.2.0-r0 |
| debian 10 | dask.distributed | kein Fix angegeben |
Alle 19 Einträge aus 19 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| pip::GitHub Security Advisory pip | distributed | 2021.10.0 |
| alpine 3.16 | py3-dask | 2022.2.0-r0 |
| alpine 3.17 | py3-dask | 2022.2.0-r0 |
| alpine 3.18 | py3-dask | 2022.2.0-r0 |
| alpine 3.19 | py3-dask | 2022.2.0-r0 |
| alpine 3.20 | py3-dask | 2022.2.0-r0 |
| alpine 3.21 | py3-dask | 2022.2.0-r0 |
| alpine 3.22 | py3-dask | 2022.2.0-r0 |
| alpine 3.23 | py3-dask | 2022.2.0-r0 |
| alpine 3.24 | py3-dask | 2022.2.0-r0 |
| alpine edge | py3-dask | 2022.2.0-r0 |
| debian 10 | dask.distributed | kein Fix angegeben |
| debian 11 | dask.distributed | 2021.01.0+ds.1-2.1+deb11u1 |
| debian 12 | dask.distributed | 2021.09.1+ds.1-2 |
| debian 13 | dask.distributed | 2021.09.1+ds.1-2 |
| debian 14 | dask.distributed | 2021.09.1+ds.1-2 |
| echo | dask.distributed | 2021.09.1+ds.1-2 |
| ubuntu 18.04-ESM | dask.distributed | kein Fix angegeben |
| ubuntu 20.04-ESM | dask.distributed | kein Fix angegeben |
Referenzen
- https://docs.dask.org/en/latest/changelog.html
- https://github.com/dask/dask/tags
- https://github.com/dask/distributed
- https://github.com/dask/distributed/commit/afce4be8e05fb180e50a9d9e38465f1a82295e1b
- https://github.com/dask/distributed/pull/5427
- https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-871.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-872.yaml