CVE-2024-10096

github.com/dask/dask: Remote Unauthorized Pickle Deserialization Command Execution in dask/dask

View on CVE.org
Published Mar 20, 2025 CVSS 3.0 · 9.8 Critical EPSS n/a KEV · Not listed
Description
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-7119 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Github GHSA Github GHSA GHSA-xqgj-r6xv-9cw4 Withdrawn Advisory: Dask Vulnerable to Command Injection
History
Type Values Removed Values Added
Title github.com/dask/dask: Remote Unauthorized Pickle Deserialization Command Execution in dask/dask
Weaknesses CWE-77
References
Metrics cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Weaknesses CWE-77
References
Metrics cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Type Values Removed Values Added
Title Remote Unauthorized Pickle Deserialization Command Execution in dask/dask
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Dask versions <=2024.8.2 contain a vulnerability in the Dask Distributed Server where the use of pickle serialization allows attackers to craft malicious objects. These objects can be serialized on the client side and sent to the server for deserialization, leading to remote command execution and potentially granting full control over the Dask server. This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Dask versions <=2024.8.2 contain a vulnerability in the Dask Distributed Server where the use of pickle serialization allows attackers to craft malicious objects. These objects can be serialized on the client side and sent to the server for deserialization, leading to remote command execution and potentially granting full control over the Dask server.
Title Remote Unauthorized Pickle Deserialization Command Execution in dask/dask
Weaknesses CWE-77
References
Metrics cvssV3_0

{'score': 9.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses

Sources

Status
REJECTED
Assigner
@huntr_ai
Published
Updated
Mar 26, 2025, 4:41 PM
Reserved
Oct 17, 2024, 4:51 PM

View source JSON

Updated

JSON

Status
Rejected
Published
Mar 20, 2025, 10:15 AM
Modified
Oct 16, 2026, 1:10 PM

View source JSON

Severity
Public date
Mar 20, 2025, 10:09 AM

View source Bugzilla JSON

No data.