CVE-2021-42343
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-42343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Python Dask 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Python Dask是一个灵活的 Python 并行计算库。 Dask 存在安全漏洞，该漏洞源于以Dask .distributed.LocalCluster或Dask .distributed. client(默认使用LocalCluster)启动的单机Dask集群将错误地配置各自的Dask工作人员侦听外部接口(通常使用随机选择的高端口)，而不是仅在本地主机上。使用此方法创建的Dask集群(当运行在公开适用端口的机器上时)可能被复杂的攻击者可利用该漏洞用于实现远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2021-42343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-42343
请登录查看更多情报信息。
- https://github.com/dask/dask/tagsx_refsource_MISC
- https://docs.dask.org/en/latest/changelog.htmlx_refsource_MISC
- https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxrx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2021-42343
Same Patch Batch · n/a · 2021-10-26 · 14 CVEs total
| CVE-2021-41866 | MyBB 跨站脚本漏洞 | |
| CVE-2020-22864 | Froala WYSIWYG Editor 跨站脚本漏洞 | |
| CVE-2021-37364 | OpenClinic GA 安全漏洞 | |
| CVE-2021-37363 | Gestionale Open Srl Gestionale Open 安全漏洞 | |
| CVE-2021-37372 | Online Student Admission System 代码问题漏洞 | |
| CVE-2021-37371 | Online Student Admission System SQL注入漏洞 | |
| CVE-2011-4119 | Caml-light 安全漏洞 | |
| CVE-2011-2195 | websvn 操作系统命令注入漏洞 | |
| CVE-2021-41078 | Nameko 代码问题漏洞 | |
| CVE-2021-41873 | Penguin Aurora TV Box 41502 安全漏洞 | |
| CVE-2021-40344 | Nagios XI 代码问题漏洞 | |
| CVE-2021-40343 | Nagios XI 安全漏洞 | |
| CVE-2021-40345 | Nagios XI 命令注入漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2021-42343
No comments yet