CVE-2021-42343

Name	CVE-2021-42343
Description	An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
dask.distributed (PTS)	bullseye	2021.01.0+ds.1-2.1+deb11u1	fixed
	bookworm	2022.12.1+ds.1-3	fixed
	forky, sid, trixie	2024.12.1+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
dask.distributed	source	bullseye	2021.01.0+ds.1-2.1+deb11u1
dask.distributed	source	(unstable)	2021.09.1+ds.1-2

Notes

[buster] - dask.distributed <ignored> (Minor issue; unreproducible with <2.0)
https://github.com/dask/distributed/pull/5427
https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
Likely introduced in https://github.com/quasiben/distributed/commit/fd31ecca8017bae845a73d468de0376c02363fab (2.0.0)