CVE Vulnerability

CVE-2021-42343

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://docs.dask.org/en/latest/changelog.html Release Notes Vendor Advisory
https://github.com/dask/dask/tags Third Party Advisory
https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:anaconda:dask:*:*:*:*:*:python:*:*
Information

Published : 2021-10-26 11:15

Updated : 2022-07-12 05:42

NVD link : CVE-2021-42343

Mitre link : CVE-2021-42343

Products Affected
No products.
CWE
NVD-CWE-Other