CVE-2021-42343

Katalog CVE

CVSS 9.8 · Critical EPSS 3,0%

Kerentanan pada anaconda dask. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.

Rincian

Terbit di NVD

26 Oktober 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 86,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://docs.dask.org/en/latest/changelog.html release notes · advisory vendor
• https://github.com/dask/dask/tags advisory pihak ketiga
• https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr advisory pihak ketiga