noah-vega (>=1.2.0, <=1.7.1) potentially affected by CVE-2021-42343 via distributed (2.18.0)

distributed PYPI version 2.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - noah-vega =1.2.0, =1.7.1 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

hypycube (0.0.0a0), prefect (>=0.9.5, <=0.12.2) +2 more potentially affected by CVE-2021-42343 via distributed (2.20.0)

distributed PYPI version 2.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - hypycube 0.0.0a0 - prefect =0.9.5, =0.6.5, =0.0.22.dev7, =0.0.24.dev0 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWX...

streaming-anomaly-detection (>=0.0.7, <=0.0.9) potentially affected by CVE-2021-42343 via distributed (2.21.0)

distributed PYPI version 2.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - streaming-anomaly-detection =0.0.7, =0.0.9 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

devito (4.2.3) potentially affected by CVE-2021-42343 via distributed (2.22.0)

distributed PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - devito 4.2.3 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

oracle-ads (>=2.3.3, <=2.4.1) potentially affected by CVE-2021-42343 via distributed (2.30.0)

distributed PYPI version 2.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - oracle-ads =2.3.3, =2.4.1 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

azureml-automl-dnn-nlp (>=1.37.0, <=1.46.1.post1), azureml-automl-dnn-vision (>=1.37.0, <=1.46.1) +31 more potentially affected by CVE-2021-42343 via distributed (2.30.1)

distributed PYPI version 2.30.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - azureml-automl-dnn-nlp =1.37.0, =1.37.0, =1.34.0, =1.37.0, =1.37.0, =0.1.0, =0.9.22.post0, =0.1.0, =0.1.0, =0.1.0a1, =0.0.5, =0.0.5, =0.1...

azureml-automl-dnn-nlp (>=1.47.0, <=1.48.0.post1), azureml-automl-dnn-vision (>=1.47.0, <=1.48.0) +26 more potentially affected by CVE-2021-42343 via distributed (>=2021.1.1, <=2021.9.1)

distributed PYPI version =2021.1.1, =1.47.0, =1.47.0, =1.47.0, =1.47.0, =1.47.0.post1, =1.33.1, =3.0.0.dev4, =0.19.0a210422, =4.3.0, =2021.8.2.dev2, =0.0.0, =0.3.7, =0.3.17 - gam 1.1.1 and more Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

dataverk (0.2.13) potentially affected by CVE-2021-42343 via distributed (2.5.1)

distributed PYPI version 2.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dataverk 0.2.13 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

complai-test (0.1.0), sphinxcontrib-jupyter (>=0.5.4, <=0.5.5) potentially affected by CVE-2021-42343 via distributed (2.5.2)

distributed PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - complai-test 0.1.0 - sphinxcontrib-jupyter =0.5.4, =0.5.5 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

dataprep (>=0.2.10a0, <=0.2.13.post2) potentially affected by CVE-2021-42343 via distributed (2.10.0)

distributed PYPI version 2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dataprep =0.2.10a0, =0.2.13.post2 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

autogluon (>=0.0.5, <=0.0.7b17042020), azureml-automl-dnn-nlp (>=1.37.0, <=1.48.0.post1) +74 more potentially affected by CVE-2021-42343 via distributed (>=1.13.0, <=2021.9.1)

distributed PYPI version =1.13.0, =0.0.5, =1.37.0, =1.37.0, =1.34.0, =1.37.0, =1.37.0, =0.1.19008.12a1, =1.33.1, =3.0.0.dev4, =1.1.1.6, =0.1.0, =0.2.1 and more Source cves: CVE-2021-42343 Source advisory: GHSA-HWQR-F3V9-HWXR...

elfi (0.3.1) potentially affected by CVE-2021-42343 via distributed (1.14.3)

distributed PYPI version 1.14.3 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - elfi 0.3.1 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

pp-role-mining (>=0.0.1, <=0.0.6) potentially affected by CVE-2021-42343 via distributed (1.21.8)

distributed PYPI version 1.21.8 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - pp-role-mining =0.0.1, =0.0.6 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

libertem (>=0.2.0, <=0.2.2) potentially affected by CVE-2021-42343 via distributed (1.27.1)

distributed PYPI version 1.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - libertem =0.2.0, =0.2.2 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

GHSA-HWQR-F3V9-HWXR Workers for local Dask clusters mistakenly listened on public interfaces

Versions of distributed earlier than 2021.10.0 had a potential security vulnerability relating to single-machine Dask clusters. Clusters started with dask.distributed.LocalCluster or dask.distributed.Client which defaults to using LocalCluster would mistakenly configure their respective Dask...

dask-janelia (0.1.2), fibsem-tools (>=0.1.3, <=0.1.4) potentially affected by CVE-2021-42343 via distributed (2020.12.0)

distributed PYPI version 2020.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on distributed and may be impacted: - dask-janelia 0.1.2 - fibsem-tools =0.1.3, =0.1.4 Source cves: CVE-2021-42343 Source advisory: OSV:GHSA-HWQR-F3V9-HWXR...

CVE-2021-42343

An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters started with dask.distributed.LocalCluster or dask.distributed.Client which defaults to using LocalCluster would mistakenly configure their respective Dask workers to listen on extern...

pybnf (>=0.3.1, <=1.1.6) potentially affected by CVE-2021-42343 via dask (0.20.0)

dask PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on dask and may be impacted: - pybnf =0.3.1, =1.1.6 Source cves: CVE-2021-42343 Source advisory: OSV:PYSEC-2021-387...

dye-score (0.1.0) potentially affected by CVE-2021-42343 via dask (1.1.5)

dask PYPI version 1.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on dask and may be impacted: - dye-score 0.1.0 Source cves: CVE-2021-42343 Source advisory: OSV:PYSEC-2021-387...

sphinxcontrib-jupyter (>=0.5.4, <=0.5.5) potentially affected by CVE-2021-42343 via dask (2.5.2)

dask PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on dask and may be impacted: - sphinxcontrib-jupyter =0.5.4, =0.5.5 Source cves: CVE-2021-42343 Source advisory: OSV:PYSEC-2021-387...