CVE-2021-42343: Dask distributed Package Remote Code Execution
Summary
CVE-2021-42343: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Affects distributed versions < 2021.10.0. Fixed in 2021.10.0. How to fix ↓
Also tracked for
- dask · PyPI
- dask.distributed · Debian:11
- dask · PyPI
The same CVE-2021-42343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Dask distributed package is a Python library that provides distributed computing capabilities for large-scale data processing. It allows users to create distributed clusters and execute computations across multiple machines. The package is commonly used in data science and machine learning applications to parallelize and scale data processing tasks. However, a vulnerability has been discovered in versions before 2021.10.0 that can lead to remote code execution.
Vulnerability Detail
The vulnerability in the Dask distributed package arises when single machine Dask clusters are started using dask.distributed.LocalCluster or dask.distributed.Client. By default, these clusters configure their workers to listen on external interfaces instead of only on localhost. This misconfiguration can allow a sophisticated attacker to exploit the exposed port and gain remote code execution capabilities. This means that an attacker could potentially execute arbitrary code on the affected machine, leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Minimum fixed version
2021.10.0
This is the first release that contains the fix.
pip install --upgrade "distributed==2021.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, users can implement a workaround by manually configuring the Dask workers to listen only on localhost. This can be done by modifying the Dask configuration file or by passing the appropriate arguments when starting the Dask cluster. For example, when using dask.distributed.LocalCluster, the 'host' parameter can be set to 'localhost' to restrict worker communication to the local machine.
Conclusion
The vulnerability in the Dask distributed package before 2021.10.0 can allow remote code execution, posing a significant security risk. Users are advised to upgrade to the latest version or apply the recommended workaround to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for distributed →
FAQ
Dask distributed is a Python library that enables distributed computing for large-scale data processing. It allows users to create distributed clusters and execute computations across multiple machines.
The vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the affected machine. This can result in unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, it is recommended to upgrade to version 2021.10.0 or later of the Dask distributed package. Alternatively, you can manually configure the Dask workers to listen only on localhost.
Yes, if upgrading to the latest version is not immediately feasible, you can manually configure the Dask workers to listen only on localhost. This can be done by modifying the Dask configuration file or passing the appropriate arguments when starting the Dask cluster.
There is no known exploit publicly available at the moment. However, it is important to address this vulnerability promptly to mitigate the risk of potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for distributed.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
