PyPI/distributed CVE-2021-42343: critical 9.8, EPSS 2.98%

Workers for local Dask clusters mistakenly listened on public interfaces

Action: Upgrade distributed to 2021.10.0 or later.

pip install distributed==2021.10.0

Affected

Fixed versions

Sources

• osv: GHSA-hwqr-f3v9-hwxr
• https://github.com/dask/distributed/security/advisories/GHSA-hwqr-f3v9-hwxr
• https://nvd.nist.gov/vuln/detail/CVE-2021-42343
• https://github.com/dask/distributed/pull/5427
• https://github.com/dask/distributed/commit/afce4be8e05fb180e50a9d9e38465f1a82295e1b
• https://docs.dask.org/en/latest/changelog.html
• https://github.com/dask/dask/tags
• https://github.com/dask/distributed
• https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-871.yaml
• https://github.com/pypa/advisory-database/tree/main/vulns/distributed/PYSEC-2021-872.yaml

CVE-2021-42343 · published 2022-07-15T21:56:08Z · modified 2026-07-09T16:56:37.896815557Z · JSON