An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | dask | < 2021.10.0 | 2021.10.0 |
| Python (PyPI) | distributed | < 2021.10.0 | 2021.10.0 |
Referencias
- https://docs.dask.org/en/latest/changelog.html
- https://github.com/dask/dask/tags
- https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
- https://github.com/advisories/GHSA-j8fq-86c5-5v2r
- https://github.com/advisories/GHSA-hwqr-f3v9-hwxr
- https://nvd.nist.gov/vuln/detail/CVE-2021-42343
- https://github.com/dask/distributed/pull/5427
- https://github.com/dask/distributed/commit/afce4be8e05fb180e50a9d9e38465f1a82295e1b
- https://github.com/dask/distributed
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-871.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-872.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/dask/PYSEC-2021-387.yaml
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Debilidad (CWE)
CWE-668- Plataforma
- Python (PyPI)
- Paquete
dask, distributed- Publicada
- 26.10.2021
- Actualizado
- 11.10.2026 13:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2021-387 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2021-872 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-hwqr-f3v9-hwxr - CC BY 4.0
OSV / GitHub Advisory Database - GHSA-j8fq-86c5-5v2r - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2021-871 - PyPA Advisory Database; CC BY 4.0
Historial de vulnerabilidades: dask
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.