Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/hail@0.2.56
Typepypi
Namespace
Namehail
Version0.2.56
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version0.2.127
Latest_non_vulnerable_version0.2.127
Affected_by_vulnerabilities
0
url VCID-534z-ur24-6kcj
vulnerability_id VCID-534z-ur24-6kcj
summary Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user's domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `test@example.org`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.
references
0
reference_url https://github.com/hail-is/hail
reference_id
reference_type
scores
url https://github.com/hail-is/hail
1
reference_url https://github.com/hail-is/hail/commit/0dcc17ff24564b6f5592261d7975e8afd0f95de7
reference_id
reference_type
scores
url https://github.com/hail-is/hail/commit/0dcc17ff24564b6f5592261d7975e8afd0f95de7
2
reference_url https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://github.com/hail-is/hail/security/advisories/GHSA-487p-qx68-5vjw
3
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/hail/PYSEC-2023-271.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/hail/PYSEC-2023-271.yaml
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-51663
reference_id CVE-2023-51663
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2023-51663
5
reference_url https://github.com/advisories/GHSA-487p-qx68-5vjw
reference_id GHSA-487p-qx68-5vjw
reference_type
scores
url https://github.com/advisories/GHSA-487p-qx68-5vjw
fixed_packages
0
url pkg:pypi/hail@0.2.127
purl pkg:pypi/hail@0.2.127
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/hail@0.2.127
aliases CVE-2023-51663, GHSA-487p-qx68-5vjw, PYSEC-2023-271
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-534z-ur24-6kcj
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/hail@0.2.56