critical
CVE-2021-42343
An issue was discovered in the Dask distributed package before 2021.10 ...
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Ubuntu (medium).
Description
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | distributed | 2021.10.0 |
| alpine 3.16 | py3-dask | 2022.2.0-r0 |
| alpine 3.17 | py3-dask | 2022.2.0-r0 |
| alpine 3.18 | py3-dask | 2022.2.0-r0 |
| alpine 3.19 | py3-dask | 2022.2.0-r0 |
| alpine 3.20 | py3-dask | 2022.2.0-r0 |
| alpine 3.21 | py3-dask | 2022.2.0-r0 |
| alpine 3.22 | py3-dask | 2022.2.0-r0 |
| alpine 3.23 | py3-dask | 2022.2.0-r0 |
| alpine 3.24 | py3-dask | 2022.2.0-r0 |
| alpine edge | py3-dask | 2022.2.0-r0 |
| debian 10 | dask.distributed | no fix listed |
Show all 19 entries from 19 sources
| Source | Package | Fixed in |
|---|---|---|
| pip::GitHub Security Advisory pip | distributed | 2021.10.0 |
| alpine 3.16 | py3-dask | 2022.2.0-r0 |
| alpine 3.17 | py3-dask | 2022.2.0-r0 |
| alpine 3.18 | py3-dask | 2022.2.0-r0 |
| alpine 3.19 | py3-dask | 2022.2.0-r0 |
| alpine 3.20 | py3-dask | 2022.2.0-r0 |
| alpine 3.21 | py3-dask | 2022.2.0-r0 |
| alpine 3.22 | py3-dask | 2022.2.0-r0 |
| alpine 3.23 | py3-dask | 2022.2.0-r0 |
| alpine 3.24 | py3-dask | 2022.2.0-r0 |
| alpine edge | py3-dask | 2022.2.0-r0 |
| debian 10 | dask.distributed | no fix listed |
| debian 11 | dask.distributed | 2021.01.0+ds.1-2.1+deb11u1 |
| debian 12 | dask.distributed | 2021.09.1+ds.1-2 |
| debian 13 | dask.distributed | 2021.09.1+ds.1-2 |
| debian 14 | dask.distributed | 2021.09.1+ds.1-2 |
| echo | dask.distributed | 2021.09.1+ds.1-2 |
| ubuntu 18.04-ESM | dask.distributed | no fix listed |
| ubuntu 20.04-ESM | dask.distributed | no fix listed |
References
- https://docs.dask.org/en/latest/changelog.html
- https://github.com/dask/dask/tags
- https://github.com/dask/distributed
- https://github.com/dask/distributed/commit/afce4be8e05fb180e50a9d9e38465f1a82295e1b
- https://github.com/dask/distributed/pull/5427
- https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-871.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-872.yaml