GHSA-XQGJ-R6XV-9CW4严重已审查已撤回

Withdrawn Advisory: Dask Vulnerable to Command Injection

OSV 1.4.0 · github-reviewed · 修改于 2025-03-28 23:35

发布时间

2025-03-20 20:32

GitHub 审查时间

2025-03-21 03:03

NVD 发布时间

2025-03-20 18:15

源文件

advisories/github-reviewed/2025/03/GHSA-xqgj-r6xv-9cw4/GHSA-xqgj-r6xv-9cw4.json

该公告已于 2025-03-28 23:35 撤回

内容仅用于保留外部引用，请不要将其当作仍然有效的安全结论。

公告说明

Withdrawn Advisory

This advisory has been withdrawn because it describes intended functionality. This link is maintained to preserve external references.

Original Description

Dask versions <=2024.8.2 contain a vulnerability in the Dask Distributed Server where the use of pickle serialization allows attackers to craft malicious objects. These objects can be serialized on the client side and sent to the server for deserialization, leading to remote command execution and potentially granting full control over the Dask server.

受影响的软件包

PyPI

dask

ECOSYSTEM

标识信息

别名 / CVE

CVE-2024-10096

CWE

CWE-77

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

原始 OSV JSON

{
  "id": "GHSA-xqgj-r6xv-9cw4",
  "aliases": [
    "CVE-2024-10096"
  ],
  "details": "# Withdrawn Advisory\nThis advisory has been withdrawn because it describes [intended functionality](https://distributed.dask.org/en/stable/limitations.html?highlight=host#security). This link is maintained to preserve external references.\n\n# Original Description\n\nDask versions <=2024.8.2 contain a vulnerability in the Dask Distributed Server where the use of pickle serialization allows attackers to craft malicious objects. These objects can be serialized on the client side and sent to the server for deserialization, leading to remote command execution and potentially granting full control over the Dask server.",
  "summary": "Withdrawn Advisory: Dask Vulnerable to Command Injection",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "2024.8.2"
            }
          ]
        }
      ],
      "package": {
        "name": "dask",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2025-03-28T15:35:32Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "published": "2025-03-20T12:32:38Z",
  "withdrawn": "2025-03-28T15:35:32Z",
  "references": [
    {
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10096",
      "type": "ADVISORY"
    },
    {
      "url": "https://github.com/dask/dask",
      "type": "WEB"
    },
    {
      "url": "https://huntr.com/bounties/a4be847b-a52d-42cc-9e78-3299e2d30ab2",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "nvd_published_at": "2025-03-20T10:15:14Z",
    "github_reviewed_at": "2025-03-20T19:03:57Z"
  }
}