ilcdirac (>=34.0.0a4, <=34.0.0a8) potentially affected by CVE-2024-29905 via dirac (7.3.36)

dirac PYPI version 7.3.36 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac =34.0.0a4, =34.0.0a8 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

ilcdirac (33.0.0a1) potentially affected by CVE-2024-29905 via dirac (7.2.30)

dirac PYPI version 7.2.30 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac 33.0.0a1 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

ctadirac (>=2.0.33, <=2.1.13) potentially affected by CVE-2024-29905 via dirac (7.3.23)

dirac PYPI version 7.3.23 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ctadirac =2.0.33, =2.1.13 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

lhcbdirac (>=10.2.5, <=10.2.16) potentially affected by CVE-2024-29905 via dirac (7.2.52)

dirac PYPI version 7.2.52 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - lhcbdirac =10.2.5, =10.2.16 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

ctadirac (>=2.2.0a1, <=2.2.46) potentially affected by CVE-2024-29905 via dirac (>=8.0.0, <=8.0.40)

dirac PYPI version =8.0.0, =2.2.0a1, =2.2.46 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

comdirac (>=0.22.0, <=1.3.3), ctadirac (>=2.0.0a7, <=2.0.6) +3 more potentially affected by CVE-2024-29905 via dirac (7.3.38)

dirac PYPI version 7.3.38 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - comdirac =0.22.0, =2.0.0a7, =34.0.0, =10.3.0a3, =10.4.23 - lhcbwebdirac 5.3.0a2 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

ilcdirac (33.0.0a2) potentially affected by CVE-2024-29905 via dirac (7.2.40)

dirac PYPI version 7.2.40 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac 33.0.0a2 Source cves: CVE-2024-29905 Source advisory: OSV:GHSA-V6F3-GH5H-MQWX...

DIRAC: Unauthorized users can read proxy contents during generation

Impact During the proxy generation process e.g., when using dirac-proxy-init it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a...

DIRAC security vulnerabilities

DIRAC is an open source software framework for distributed computing from the DIRAC Project. A security vulnerability exists in DIRAC versions prior to 8.0.41, which stems from the possibility that an unauthorized user could gain read access to the agent, allowing the user to perform any action...

CVE-2024-29905: Exposure of Resource to Wrong Sphere

DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process e.g., when using dirac-proxy-init, it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then...

Improper Authorization

DIRAC is vulnerable to Improper Authorization. The vulnerability is caused due to the TokenManager not checking permissions on cached tokens. This allows an attacker to use improperly cached tokens to gain access to resources, data, or functionalities within the DIRAC system for which they do not...

CVE-2024-24825

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known...

PYSEC-2024-125

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known...

ilcdirac (>=34.0.0a4, <=34.0.0a8) potentially affected by CVE-2024-24825 via dirac (7.3.36)

dirac PYPI version 7.3.36 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac =34.0.0a4, =34.0.0a8 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...

ctadirac (>=2.0.33, <=2.1.13) potentially affected by CVE-2024-24825 via dirac (7.3.23)

dirac PYPI version 7.3.23 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ctadirac =2.0.33, =2.1.13 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...

ilcdirac (33.0.0a1) potentially affected by CVE-2024-24825 via dirac (7.2.30)

dirac PYPI version 7.2.30 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac 33.0.0a1 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...

ilcdirac (33.0.0a2) potentially affected by CVE-2024-24825 via dirac (7.2.40)

dirac PYPI version 7.2.40 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ilcdirac 33.0.0a2 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...

ctadirac (>=2.2.0a1, <=2.2.35) potentially affected by CVE-2024-24825 via dirac (>=8.0.0, <=8.0.30)

dirac PYPI version =8.0.0, =2.2.0a1, =2.2.35 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...

Design/Logic Flaw

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known...

ctadirac (>=2.0.0a0, <=2.0.31) potentially affected by CVE-2024-24825 via dirac (7.3.12)

dirac PYPI version 7.3.12 is affected by a known vulnerability. The following packages have a transitive dependency on dirac and may be impacted: - ctadirac =2.0.0a0, =2.0.31 Source cves: CVE-2024-24825 Source advisory: OSV:PYSEC-2024-125...