Staging Environment: Content and features may be unstable or change without notice.

Advisory Package Curation

CVE-2024-24825

Progress 0 / 0

Advisory Summaries

github_osv/GHSA-59qj-jcjv-662j

DIRAC's TokenManager does not check permissions on cached tokens ### Impact Any user could get a token that has been requested by another user/agent ### Patches The vulnerability is fixed in version 8.0.37. ### Workarounds None ### References

gitlab/pypi/DIRAC/CVE-2024-24825

DIRAC's TokenManager does not check permissions on cached tokens Any user could get a token that has been requested by another user/agent

pypa/dirac/PYSEC-2024-125

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.

pysec/PYSEC-2024-125

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known workarounds for this vulnerability.