Race Condition Affecting prefect package, versions [3.0.0rc2,3.0.0rc4)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PREFECT-7413653
- published 1 Jul 2024
- disclosed 1 Jul 2024
- credit Chris Guidry
How to fix?
Upgrade prefect to version 3.0.0rc4 or higher.
Overview
prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest.
Affected versions of this package are vulnerable to Race Condition that could lead to operational inconsistencies and potential security vulnerabilities. This issue arises when multiple processes attempt to update the state of the same flow run concurrently, leading to conflicts such as duplicate flow run executions.