Open-source package vulnerability · PyPI
CVE-2024-24825: DIRAC's TokenManager does not check permissions on cached tokens
criticalCVSS 3.1 9.1GHSA-59qj-jcjv-662j
Impact Any user could get a token that has been requested by another user/agent Patches The vulnerability is fixed in version 8.0.37. Workarounds None References
Published Feb 8, 2024 · Updated Nov 21, 2024
Affected packages
DIRAC
- Ecosystem
- PyPI
- Affected
- >= 8.0.0, < 8.0.37
- Fixed in
- 8.0.37
- Check
pip show DIRAC
dirac
- Ecosystem
- PyPI
- Affected
- >= 0, < 8.0.37
- Fixed in
- 8.0.37
- Check
pip show dirac
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Impact
Any user could get a token that has been requested by another user/agent
Patches
The vulnerability is fixed in version 8.0.37.
Workarounds
None
References
Credited to chaen, aldbr, chrisburr.
References
- https://github.com/DIRACGrid/DIRAC/security/advisories/GHSA-59qj-jcjv-662j
- https://github.com/DIRACGrid/DIRAC/commit/9487921684e2925b4cf72d6c423718cf4950f3fe
- https://github.com/DIRACGrid/DIRAC/commit/f9ddab755b9a69acb85e14d2db851d8ac0c9648c
- https://nvd.nist.gov/vuln/detail/CVE-2024-24825
- https://github.com/pypa/advisory-database/tree/main/vulns/dirac/PYSEC-2024-125.yaml
- https://github.com/advisories/GHSA-59qj-jcjv-662j
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology