CVE-2021-42343: Dask distributed Package Remote Code Execution
Summary
CVE-2021-42343: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Affects distributed versions < 2021.10.0. Fixed in 2021.10.0. How to fix ↓
Also tracked for
- dask · PyPI
- dask.distributed · Debian:11
- dask · PyPI
The same CVE-2021-42343 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Dask distributed package is a Python library that provides distributed computing capabilities for parallel computing and task scheduling. It allows users to create distributed clusters for executing computational tasks across multiple machines. The package is commonly used in data processing and analysis workflows. However, prior to version 2021.10.0, the package had a vulnerability that could lead to remote code execution.
Vulnerability Detail
The vulnerability in the Dask distributed package (before 2021.10.0) allowed single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client to mistakenly configure their workers to listen on external interfaces instead of only on localhost. This meant that a Dask cluster created using this method could be accessed by an attacker if the machine had an applicable port exposed. A sophisticated attacker could exploit this to achieve remote code execution, potentially compromising the entire cluster and the data being processed.
How To Fix
Minimum fixed version
2021.10.0
This is the first release that contains the fix.
pip install --upgrade "distributed==2021.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, users can manually configure the Dask workers to listen only on localhost by setting the host parameter to '127.0.0.1' when creating the LocalCluster or Client. For example:
from dask.distributed import LocalCluster, Client
cluster = LocalCluster(host='127.0.0.1') client = Client(cluster)
Conclusion
The Dask distributed package before version 2021.10.0 had a vulnerability that could allow remote code execution on Dask clusters. Users are advised to upgrade to the fixed version or apply the workaround to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for distributed →
FAQ
The vulnerability allows a sophisticated attacker to achieve remote code execution on a Dask cluster, potentially compromising the entire cluster and the data being processed.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
There are no known public exploits of this vulnerability at the time of this advisory. However, it is recommended to apply the fix or workaround as soon as possible to mitigate the risk.
Yes, this vulnerability can be exploited remotely if the machine running the Dask cluster has an applicable port exposed and accessible by an attacker.
There is no evidence of active exploitation of this vulnerability at the time of this advisory. However, it is recommended to apply the fix or workaround to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for distributed.
