Vulnerability in distributed package: Workers for local Dask clusters mistakenly listened on public interfaces
Summary
CVE-2021-42343: Workers for local Dask clusters mistakenly listened on public interfaces. Affects distributed versions < 2021.10.0. Fixed in 2021.10.0. How to fix ↓
Also tracked for
- dask · PyPI
- dask.distributed · Debian:11
- dask · PyPI
The same CVE-2021-42343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The distributed package is a Python library that provides a framework for distributed computing. It allows users to create and manage distributed Dask clusters, which are used for parallel and distributed computing tasks. The package includes features such as task scheduling, data distribution, and fault tolerance. However, versions of the distributed package prior to 2021.10.0 had a security vulnerability related to single-machine Dask clusters.
Vulnerability Detail
The vulnerability in the distributed package allowed Dask workers in local clusters to mistakenly listen on public interfaces instead of only on localhost. This meant that if the machine running the Dask cluster had the exposed ports, a sophisticated attacker could potentially exploit this vulnerability to enable remote code execution. The vulnerability was documented in CVE-2021-42343 and was fixed in version 2021.10.0 of the distributed package.
How To Fix
Minimum fixed version
2021.10.0
This is the first release that contains the fix.
pip install --upgrade "distributed==2021.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the distributed package is not immediately possible, users can mitigate the vulnerability by ensuring that the exposed ports on the machine running the Dask cluster are properly secured. This can be done by configuring the firewall to block access to the ports or by running the Dask cluster on a machine with restricted network access.
Conclusion
The vulnerability in the distributed package allowed Dask workers in local clusters to listen on public interfaces, potentially enabling remote code execution. Users should update to version 2021.10.0 or later to fix the vulnerability. If immediate update is not possible, securing the exposed ports can mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for distributed →
FAQ
The distributed package is a Python library used for creating and managing distributed Dask clusters.
A Dask cluster is a group of Dask workers that work together to perform parallel and distributed computing tasks.
The vulnerability could allow a sophisticated attacker to enable remote code execution on a machine running a Dask cluster with exposed ports.
To fix the vulnerability, update the distributed package to version 2021.10.0 or later.
If updating the distributed package is not immediately possible, secure the exposed ports on the machine running the Dask cluster by configuring the firewall or restricting network access.
References
Related vulnerabilities
Recent vulnerabilities recorded for distributed.
